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H.  R.  6357 


To  amend  the  Public  Health  Sendee  Act  to  promote  the  adoption  of  health 
information  technology,  and  for  other  purposes. 


IN  THE  HOUSE  OF  REPRESENTATIVES 

June  24,  2008 

Mr.  Dixgell  (for  himself,  Mr.  Baeton  of  Texas,  Mr.  PALLONE,  Mr.  DEAL 
of  Georgia,  Mr.  Gordon  of  Tennessee,  Mr.  Hall  of  Texas,  Mr.  Towns, 
Mr.  Upton,  Mr.  Engel,  Mrs.  Wilson  of  New  Mexico,  Mr.  Gonzalez, 
Mr.  GlNGREY,  and  Mrs.  BiGGERT)  introduced  the  following  bill;  which 
was  referred  to  the  Committee  on  Energy  and  Commerce,  and  in  addition 
to  the  Committees  on  Science  and  Technology  and  Ways  and  Means,  for 
a  period  to  be  subsequently  determined  by  the  Speaker,  in  each  case  for 
consideration  of  such  provisions  as  fall  within  the  jurisdiction  of  the  com- 
mittee concerned 


A  BILL 

To  amend  the  Public  Health  Service  Act  to  promote  the 
adoption  of  health  information  technology,  and  for  other 
purposes. 

1  Be  it  enacted  by  the  Senate  and  House  of  Representa- 

2  tives  of  the  United  States  of  America  in  Congress  assembled, 

3  SECTION  1.  SHORT  TITLE;  TABLE  OF  CONTENTS. 

4  (a)  Short  Title. — This  Act  may  be  cited  as  the 

5  "Protecting  Records,  Optimizing  Treatment,  and  Easing 


2 

1  Communication  through  Healthcare  Technology  Act  of 

2  2008"  or  the  "PRO(TECH)T  Act  of  2008". 

3  (b)  Table  of  Contents. — The  table  of  contents  of 

4  this  Act  is  as  follows: 

Sec.  1.  Short  title;  table  of  contents. 

TITLE  I— HEALTH  INFORMATION  TECHNOLOGY 
Subtitle  A — Promotion  of  Health  Information  Technology 
Part  I — Improving  Health  Care  Quality,  Safety,  and  Efficiency 

Sec.  101.  ONCHIT;  standards  development  and  adoption;  health  information 
technology  resource  center. 

'TITLE  XXX— HEALTH  INFORMATION  TECHNOLOGY  AND 

QUALITY 

"Sec.  3000.  Definitions. 

"Subtitle  A — Promotion  of  Health  Information  Technology 

"Sec.  3001.  Office  of  the  National  Coordinator  for  Health  Information 

Technology. 
"Sec.  3002.  HIT  Policy  Committee. 
"Sec.  3003.  HIT  Standards  Committee. 

"Sec.  3004.  Process  for  adoption  of  endorsed  recommendations. 

"Sec.  3005.  Application  and  use  of  adopted  standards  and  implementation 
specifications  by  Federal  agencies. 

"Sec.  3006.  Voluntary  application  and  use  of  adopted  standards  and  im- 
plementation specifications  by  private  entities. 

"Sec.  3007.  Health  Information  Technology  Resource  Center. 
Sec.  102.  Transitions. 

Part  II — Application  and  Use  of  Adopted  Health  Information 
Technology  Standards;  Reports 

Sec.  111.  Coordination  of  Federal  activities  with  adopted  standards  and  imple- 
mentation specifications. 
Sec.  112.  Application  to  private  entities. 
Sec.  113.  Reports. 

Subtitle  B — Incentives  for  the  Use  of  Health  Information  Technology 

Sec.  121.  Grant,  loan,  and  demonstration  programs. 

"Subtitle  B — Incentives  for  the  Use  of  Health  Information  Technology 

"Sec.  3011.  Grants  and  loans  to  facilitate  the  widespread  adoption  of 
qualified  health  information  technology. 

"Sec.  3012.  Demonstration  program  to  integrate  information  technology 
into  clinical  education. 

TITLE  II— TESTING  OF  HEALTH  INFORMATION  TECHNOLOGY 
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Sec.  201.  National  Institute  for  Standards  and  Technology  testing. 
See.  202.  Research  and  development  programs. 

TITLE  III— PRIVACY  AND  SECURITY  PROVISIONS 
Sec  300.  Definitions. 

Subtitle  A — Security  Provisions 

Sec.  301.  Application  of  security  provisions  and  penalties  to  business  associates 

of  covered  entities;  annual  guidance  on  security  provisions. 
See.  302.  Notification  in  the  case  of  breach. 

See.  303.  Education  on  Health  Information  Privacy  and  report  on  compliance. 

Subtitle  B — Improved  Privacy  Provisions  and  Additional  Security  Provisions 

Sec.  311.  Application  of  penalties  to  business  associates  of  covered  entities  for 

violations  of  privacy  contract  requirements. 
Sec.  312.  Restrictions  on  certain  disclosures  of  health  information;  accounting 

of  certain  protected  health  information  disclosures. 
Sec.  313.  Conditions  on  certain  contacts  as  part  of  health  care  operations. 
Sec.  314.  Study  on  application  of  privacy  and  security  requirements  to  vendors 

of  personal  health  records. 
Sec.  315.  Temporary  breach  notification  requirement  for  vendors  of  personal 

health  records. 

Sec.  316.  Business  associate  contracts  required  for  certain  entities. 

Sec.  317.  Guidance  on  implementation  specification  to  de-identify  protected 

health  information. 
Sec.  318.  GAO  report  on  treatment  disclosures. 

Sec.  319.  Clarification  of  application  of  wrongful  disclosures  criminal  penalties. 
Subtitle  C — Relationship  to  Other  Laws;  Clarification;  Effective  Date 

Sec.  321.  Relationship  to  other  laws. 
Sec.  322.  Effective  date. 
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1  TITLE  I— HEALTH  INFORMATION 

2  TECHNOLOGY 

3  Subtitle  A — Promotion  of  Health 

4  Information  Technology 

5  PART  I— IMPROVING  HEALTH  CARE  QUALITY, 

6  SAFETY,  AND  EFFICIENCY 

7  SEC.  101.  ONCHIT;  STANDARDS  DEVELOPMENT  AND  ADOP- 

8  TION;  HEALTH  INFORMATION  TECHNOLOGY 

9  RESOURCE  CENTER. 

10         (a)  In  General. — The  Public  Health  Sendee  Act 


11  (42  U.S.C.  201  et  seq.)  is  amended  by  adding  at  the  end 

12  the  following: 

13  "TITLE  XXX— HEALTH  INFORMA- 

14  TION      TECHNOLOGY  AND 

15  QUALITY 

16  "SEC.  3000.  DEFINITIONS. 


17  "In  this  title: 

18  "(1)   Enterprise  integration. — The  term 

19  'enterprise  integration'  means  the  electronic  linkage 

20  of  health  care  providers,  health  plans,  the  govern- 

21  ment,  and  other  interested  parties,  to  enable  the 

22  electronic  exchange  and  use  of  health  information 

23  among  all  the  components  in  the  health  care  infra- 

24  structure  in  accordance  with  applicable  law,  and 
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1  such  term  includes  related  application  protocols  and 

2  other  related  standards. 

3  "(2)   Health   care   provider. — The  term 

4  'health  care  provider'  means  a  hospital,  skilled  nurs- 

5  ing  facility,  nursing  facility,  home  health  entity, 

6  health  care  clinic,  Federally  qualified  health  center, 

7  group  practice  (as  defined  in  section  1877(h)(4)  of 

8  the  Social  Security  Act),  a  pharmacist,  a  pharmacy, 

9  a  laboratory,  a  physician  (as  defined  in  section 

10  1861  (r)  of  the  Social  Security  Act),  a  practitioner 

11  (as  described  in  section  1842(b)(18)(C)  of  the  Social 

12  Security  Act),  a  provider  operated  by,  or  under  con- 

13  tract  with,  the  Indian  Health  Service  or  bv  an  In- 

14  dian  tribe  (as  defined  in  the  Indian  Self-Determina- 

15  tion  and  Education  Assistance  Act),  tribal  organiza- 

16  tion,  or  urban  Indian  organization  (as  defined  in 

17  section  4  of  the  Indian  Health  Care  Improvement 

18  Act),  a  rural  health  clinic,  and  any  other  category  of 

1 9  facility  or  clinician  determined  appropriate  by  the 

20  Secretary. 

21  "(3)  Health  information. — The  term  'health 

22  information'  has  the  meaning  given  such  term  in 

23  section  1171(4)  of  the  Social  Security  Act. 

24  "(4)  Health  information  technology. — 

25  The  term  'health  information  technology'  means 
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1  hardware,  software,  license,  right,  intellectual  prop- 

2  erty,  equipment,  or  other  information  technology  (in- 

3  eluding  new  versions,  upgrades,  and  connectivity) 

4  designed  or  provided  primarily  for  the  electronic  cre- 

5  ation,  maintenance,  or  exchange  of  health  informa- 

6  tion  to  coordinate  care  or  improve  health  care  qual- 

7  ity,  efficiency,  or  research. 

8  "(5)  Health  plan. — The  term  'health  plan' 

9  has  the  meaning  given  such  term  in  section  1171(5) 

10  of  the  Social  Security  Act. 

11  "(6)  HIT  POLICY  COMMITTEE. — The  term  'HIT 

12  Policy  Committee'  means  such  Committee  estab- 

13  lished  under  section  3002(a). 

14  "(7)  HIT  standards  committee. — The  term 

15  'HIT  Standards  Committee'  means  such  Committee 

16  established  under  section  3003(a). 

17  "(8)  Individually  identifiable  health  in- 

18  formation. — The    term    'individually  identifiable 

19  health  information'  has  the  meaning  given  such  term 

20  in  section  1171(6)  of  the  Social  Security  Act. 

21  "(9)  LABORATORY. — The  term  'laboratory'  has 

22  the  meaning  given  such  term  in  section  353(a). 

23  "(10)    National   coordinator. — The  term 

24  'National  Coordinator'  means  the  head  of  the  Office 
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1  of  the  National  Coordinator  for  Health  Information 

2  Technology  established  under  section  3001(a). 

3  "(11)   Pharmacist. — The  term  'pharmacist' 

4  has  the  meaning  given  such  term  in  section  804(2) 

5  of  the  Federal  Food,  Drug,  and  Cosmetic  Act. 

6  "(12)  State. — The  term  'State'  means  each  of 
the  several  States,  the  District  of  Columbia,  Puerto 

8  Rico,  the  Virgin  Islands,  Guam,  American  Samoa, 

9  and  the  Northern  Mariana  Islands. 

io  "Subtitle  A — Promotion  of  Health 

n  Information  Technology 

12  "SEC.  3001.  OFFICE  OF  THE  NATIONAL  COORDINATOR  FOR 

1 3  HEALTH  INFORMATION  TECHNOLOGY. 

14  "(a)  Establishment. — There  is  established  within 

15  the  Department  of  Health  and  Human  Services  an  Office 

16  of  the  National  Coordinator  for  Health  Information  Tech- 

17  nology  (referred  to  in  this  section  as  the  'Office').  The  Of- 

18  fice  shall  be  headed  by  a  National  Coordinator  who  shall 

19  be  appointed  by  the  Secretary  and  shall  report  directly  to 

20  the  Secretary. 

21  "(b)  PURPOSE. — The  National  Coordinator  shall  per- 

22  form  the  duties  under  subsection  (c)  in  a  manner  con- 

23  sistent  with  the  development  of  a  nationwide  interoperable 

24  health  information  technology  infrastructure  that — 
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1  "(1)  ensures  that  each  patient's  health  informa- 

2  tion  is  secure  and  protected,  in  accordance  with  ap- 

3  plicable  law; 

4  "(2)  improves  health  care  quality,  reduces  med- 

5  ical  errors,  and  advances  the  delivery  of  patient-cen- 

6  tered  medical  care; 

7  "(3)  reduces  health  care  costs  resulting  from 

8  inefficiency,  medical  errors,  inappropriate  care,  du- 

9  plicative  care,  and  incomplete  information; 

10  "(4)  ensures  that  appropriate  information  to 

11  help  guide  medical  decisions  is  available  at  the  time 

12  and  place  of  care; 

13  "(5)  ensures  the  inclusion  of  meaningful  public 

14  input  in  such  development  of  such  infrastructure; 

15  "(6)  improves  the  coordination  of  care  and  in- 

16  formation  among  hospitals,  laboratories,  physician 

17  offices,  and  other  entities  through  an  effective  infra- 

18  structure  for  the  secure  and  authorized  exchange  of 

19  health  care  information; 

20  "(7)  improves  public  health  reporting  and  facili- 

21  tates  the  early  identification  and  rapid  response  to 

22  public  health  threats  and  emergencies,  including  bio- 

23  terror  events  and  infectious  disease  outbreaks; 

24  "(8)  facilitates  health  and  clinical  research  and 

25  health  care  quality; 
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1  "(9)  promotes  prevention  of  chronic  diseases; 

2  "(10)  promotes  a  more  effective  marketplace, 

3  greater  competition,  greater  systems  analysis,  in- 

4  creased  consumer  choice,  and  improved  outcomes  in 

5  health  care  services;  and 

6  "(11)  improves  efforts  to  reduce  health  dispari- 

7  ties. 

8  "(c)  Duties  op  the  National  Coordinator. — 

9  "(1)  Standards. — The  National  Coordinator 

10  shall  review  and  determine  whether  to  endorse  each 

11  standard,  implementation  specification,  and  certifi- 

12  cation  criterion  for  the  electronic  exchange  and  use 

13  of  health  information  that  is  recommended  by  the 

14  HIT  Standards  Committee  under  section  3003  for 

15  purposes  of  adoption  under  section  3004(b).  The  Co- 

16  ordinator  shall  make  such  determination,  and  report 

17  to  the  Secretary  such  determination,  not  later  than 

18  90  days  after  the  date  the  recommendation  is  re- 

19  ceived  by  the  Coordinator. 

20  "(2)  HIT  POLICY  coordination. — The  Na- 

21  tional  Coordinator  shall  coordinate  health  informa- 

22  tion  technology  policy  and  programs  of  the  Depart- 

23  ment  with  those  of  other  relevant  executive  branch 

24  agencies  with  a  goal  of  avoiding  duplication  of  ef- 

25  forts  and  of  helping  to  ensure  that  each  agency  un- 
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1  dertakes  health  information  technology  activities  pri- 

2  marily  within  the  areas  of  its  greatest  expertise  and 

3  technical  capability. 

4  "(3)  Strategic  plan. — 

5  "(A)  In  GENERAL. — The  National  Coordi- 

6  nator  shall,  in  consultation  with  other  appro- 

7  priate  Federal  agencies  (-including  the  National 

8  Institute  of  Standards  and  Technology),  main- 

9  tain  and  update  a  strategic  plan  with  specific 

10  objectives,  milestones,  and  metrics  for  the  fol- 

1 1  lowing: 

12  "(i)  The  electronic  exchange  and  use 

13  of  health  information  and  the  enterprise 

14  integration  of  such  information. 

15  "(ii)  The  utilization  of  an  electronic 

16  health  record  for  each  person  in  the  United 

17  States  bv  2014. 

18  "(hi)  The  incorporation  of  privacy  and 

19  security  protections  for  the  electronic  ex- 

20  change  of  an  individual's  individually  iden- 

21  tifiable  health  information. 

22  "(iv)  Ensuring  security  methods  to 

23  ensure    appropriate    authorization,  elec- 

24  tronic  authentication,  and  encryption  of 

25  health  information. 
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1  "(v)  Specifying  a  framework  for  co- 

2  ordination  and  flow  of  recommendations 

3  and  policies  under  this  subtitle  among  the 

4  Secretary,  the  National  Coordinator,  the 

5  HIT  Policy  Committee,  the  HIT  Standards 

6  Committee,  and  other  health  information 

7  exchanges  and  other  relevant  entities. 

8  "(vi)  Methods  to  foster  the  public  un- 

9  derstanding  of  health  information  tech- 

10  nology. 

11  "(vii)  Strategies  to  enhance  the  use  of 

12  health  information  technology  in  improving 

13  the  quality  of  health  care,  reducing  medical 

14  errors,  reducing  health  disparities,  and  in 

15  improving  the  continuity  of  care  among 

16  health  care  settings. 

17  "(B)     Collaboration. — The  strategic 

18  plan  shall  be  developed  and  updated  through 

19  collaboration  of  public  and  private  interests. 

20  "(C)  Measurable  outcome  goals. — 

21  The  strategic  plan  shall  include  measurable  out- 

22  come  goals. 

23  "(D)  Publication. — The  National  Coor- 

24  dinator  shall  publish  the  strategic  plan,  includ- 

25  ing  all  updates. 
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1  "(4)    WEBSITE. — The    National  Coordinator 

2  shall  maintain  and  frequently  update  an  Internet 

3  website  on  which  there  is  posted  information  that  in- 

4  eludes  the  following': 

5  "(A)  The  schedule  developed  by  the  HIT 

6  Standards  Committee  under  section  3003(b)(3). 

7  "(B)  The  recommendations  of  the  HIT 

8  Policy  Committee  under  section  3002. 

9  "(C)  Recommendations  of  the  HIT  Stand- 

10  ards  Committee  under  section  3003. 

11  "(D)  Sources  of  Federal  grant  funds  and 

12  technical  assistance  that  are  available  to  facili- 

13  tate  the  purchase  of,  or  enhance  the  utilization 

14  of,  health  information  technology  systems. 

15  "(E)  The  report  prepared  by  the  National 

16  Coordinator  under  paragraph  (5). 

17  "(F)  The  assessment  by  the  National  Co- 

18  ordinator  under  paragraph  (6). 

19  "(G)  The  evaluation  by  the  National  Coor- 

20  dinator  under  paragraph  (7). 

21  "(H)  The  annual  estimate  of  resources  re- 

22  quired  under  paragraph  (8). 

23  "(5)  Implementation  report. — The  National 

24  Coordinator  shall  prepare  a  report  that  identifies 

25  lessons  learned  from  major  public  and  private  health 
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1  care  systems  in  their  implementation  of  health  infor- 

2  mation  technology  systems,  including  information  on 

3  whether  the  systems  and  practices  developed  by  snch 

4  systems  may  be  applicable  to  and  nsable  in  whole  or 

5  in  part  by  other  health  care  providers. 

6  "(6)  Assessment  of  impact  op  hit  on  com- 
munities WITH  HEALTH  DISPARITIES  AND  UNIN- 

8  SURED,   UNDERINSURED,  AND   MEDICALLY  UNDER- 

9  SERVED  AREAS. — The  National  Coordinator  shall  as- 

10  sess  and  publish  the  impact  of  health  information 

11  technology  in  communities  with  health  disparities 

12  and  in  areas  that  serve  uninsured,  underinsnred, 

13  and  medically  underserved  individuals  (including 

14  urban  and  rural  areas)  and  identify  practices  to  in- 

15  crease  the  adoption  of  such  technology  by  health 

16  care  providers  in  snch  communities. 

17  "(7)  Evaluation  of  benefits  and  costs  of 

18  the  electronic  use  and  exchange  of  health 

19  INFORMATION. — The    National    Coordinator  shall 

20  evaluate  and  publish  evidence  on  the  benefits  and 

21  costs  of  the  electronic  use  and  exchange  of  health  in- 

22  formation  and  assess  to  whom  these  benefits  and 

23  costs  accrue. 

24  "(8)   Resource   requirements. — The  Na- 

25  tional  Coordinator  shall  estimate  and  publish  re- 
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1  sources  required  annually  to  reach  the  goal  of  utili- 

2  zation  of  an  electronic  health  record  for  each  person 

3  in  the  United  States  by  2014,  including  the  required 

4  level  of  Federal  funding,  expectations  for  regional, 

5  State,  and  private  investment,  and  the  expected  con- 

6  tributions  by  volunteers  to  activities  for  the  utiliza- 

7  tion  of  such  records. 

8  "(9)  Certification. — 

9  "(A)  In  general. — The  National  Coordi- 

10  nator,  in  consultation  with  the  Director  of  the 

11  National   Institute   of  Standards   and  Tech- 

12  nology,  shall  develop  a  program  (either  directly 

13  or  by  contract)  for  the  voluntary  certification  of 

14  health  information  technology  as  being  in  com- 

15  pliance   with   applicable   certification  criteria 

16  adopted  under  this  subtitle.  Such  program  shall 

17  include  testing  of  the  technology  in  accordance 

18  with  section  201(b)  of  the  PRO(TECH)T  Act 

19  of  2008. 

20  "(B)     Certification     criteria  de- 

21  SCRIBED. — In  this  title,  the  term  'certification 

22  criteria'  means,  with  respect  to  standards  and 

23  implementation  specifications  for  health  infor- 

24  mation  technology,  criteria  to  establish  that  the 
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1  technology  meets  such  standards  and  implemen- 

2  tation  specifications. 

3  "(d)  Detail  op  Federal  Employees. — 

4  "(1)  In  general. — Upon  the  request  of  the 

5  National  Coordinator,  the  head  of  any  Federal  agen- 

6  cy  is  authorized  to  detail,  with  or  without  reimburse- 

7  ment  from  the  Office,  any  of  the  personnel  of  such 

8  agency  to  the  Office  to  assist  it  in  carrying  out  its 

9  duties  under  this  section. 

10  "(2)  Effect  of  detail. — Any  detail  of  per- 
il sonnel  under  paragraph  (1)  shall — 

12  "(A)  not  interrupt  or  otherwise  affect  the 

13  civil  service  status  or  privileges  of  the  Federal 

14  employee;  and 

15  "(B)  be  in  addition  to  any  other  staff  of 

16  the  Department  employed  by  the  National  Co- 

17  ordinator. 

18  "(3)  Acceptance  of  detailees. — Notwith- 

19  standing  any  other  provision  of  law,  the  Office  may 

20  accept  detailed  personnel  from  other  Federal  agen- 

21  cies  without  regard  to  whether  the  agency  described 

22  under  paragraph  ( 1 )  is  reimbursed. 

23  "(e)  Authorization  of  Appropriations. — There 


24  are  authorized  to  be  appropriated  to  carry  out  this  section 

25  $66,000,000  for  fiscal  year  2009. 
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1  "SEC.  3002.  HIT  POLICY  COMMITTEE. 

2  "(a)  Establishment. — There  is  established  a  HIT 

3  Policy  Committee  to  make  policy  recommendations  to  the 

4  National  Coordinator  relating  to  the  implementation  of  a 

5  nationwide  health  information  technology  infrastrnctnre, 

6  including  implementation  of  the  strategic  plan  described 

7  in  section  3001(c)(3).  , 

8  "(b)  Duties.— 

9  "(1)  Recommendations  on  health  infor- 

10  MATION  TECHNOLOGY  INFRASTRUCTURE. — Not  later 

1 1  than  1  year  after  the  date  of  the  enactment  of  this 

12  title,  the  HIT  Policy  Committee  shall  recommend  a 

13  policy  framework  for  the  development  and  adoption 

14  of  a  nationwide  health  information  technology  infra- 

15  structure  that  permits  the  electronic  exchange  and 

16  use  of  health  information  as  is  consistent  with  the 

17  strategic  plan  under  section  3001(c)(3)  and  that  in- 

18  eludes  the  recommendations  under  paragraph  (2). 

19  Annually  thereafter  the  Committee  shall  update  such 

20  recommendations  and  make  new  recommendations 

21  as  appropriate. 

22  "(2)  Specific  areas  of  standard  develop- 

23  ment. — 

24  "(A)  In  general.— The  HIT  Policy  Com- 

25  mittee  shall  recommend  the  areas  in  which 

26  standards,  implementation  specifications,  and 
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1  certification  criteria  are  needed  for  the  elec- 

2  tronic  exchange  and  use  of  health  information 

3  for  purposes  of  adoption  under  section  3004(b) 

4  and  shall  recommend  an  order  of  priority  for 

5  the  development,  harmonization,  and  recogni- 

6  tion  of  such  standards,  specifications,  and  cri- 

7  teria  among  the  areas  so  recommended.  Such 

8  standards   and   implementation  specifications 

9  shall  include  named  standards,  architectures, 

10  and  software  schemes  for  the  authentication 

11  and  security  of  individually  identifiable  health 

12  information  and  other  information  as  needed  to 

13  ensure  the  reproducible  development  of  common 

14  solutions  across  disparate  entities. 

15  "(B)  Areas  required  for  consider- 

16  ation. — In    making   recommendations  under 

17  subparagraph  (A),  the  HIT  Policy  Committee 

18  shall  consider  at  least  the  following  areas: 

19  "(i)  Technologies  that  protect  the  pri- 

20  vacy  of  health  information  and  promote  se- 

21  curity,  including  for  the  protection  from 

22  disclosure  of  specific  individually  identifi- 

23  able  health  information,  in  accordance  with 

24  applicable  law,  and  for  the  use  and  disclo- 

25  sure  of  limited  data  sets  (as  defined  for 
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1  purposes  of  regulations  promulgated  under 

2  section  264(e)  of  the  Health  Insurance 

3  Portability    and    Accountability   Act  of 

4  1996)  of  such  information. 

5  "(ii)     A     nationwide  interoperable 

6  health  information  technology  infrastruc- 

7  ture  that  permits  the  electronic  exchange 

8  and  use  of  health  information. 

9  "(hi)  The  utilization  of  an  electronic 

10  health  record  for  each  person  in  the  United 

11  States  bv  2014. 

12  "(C)    Other   areas    for  consider- 

13  ATION. — In    making   recommendations  under 

14  subparagraph  (A),  the  HIT  Policy  Committee 

15  may  consider  the  following  additional  areas: 

16  "(i)  The  appropriate  uses  of  a  nation- 

17  wide  health  information  infrastructure,  in- 

18  eluding  for  purposes  of — 

19  "(I)  the  collection  of  quality  data 

20  and  public  reporting; 

21  "(II)  biosurveillanee  and  public 

22  health; 

23  "(III)   medical  and  clinical  re- 

24  search;  and 

25  "(IV)  drug  safety. 
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1  "(ii)  Self-service  technologies  that  fa- 

2  eilitate  the  use  and  exchange  of  patient  in- 

3  formation  and  reduce  wait  times. 

4  "(hi)    Telemedicine   technologies,  in 

5  order  to  reduce  travel  requirements  for  pa- 

6  tients  in  remote  areas. 

7  "(iv)  Technologies  that  facilitate  home 

8  health  care  and  the  monitoring  of  patients 

9  recuperating  at  home. 

10  "(v)   Technologies  that  help  reduce 

11  medical  errors. 

12  "(vi)  Technologies  that  facilitate  the 

13  continuity  of  care  among  health  settings. 

14  "(vh)    Technologies   that   meet  the 

15  needs  of  diverse  populations. 

16  "(viii)  Any  other  technology  that  the 

17  HIT  Policy  Committee  finds  to  be  among 

18  the  technologies  with  the  greatest  potential 

19  to  improve  the  quality  and  efficiency  of 

20  health  care. 

21  "(3)  FORUM.— The  HIT  Policy  Committee  shall 

22  serve  as  a  forum  for  broad  stakeholder  input  with 

23  specific  expertise  in  policies  relating  to  the  matters 

24  described  in  paragraphs  (1)  and  (2). 
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1  "(4)  Website. — The  HIT  Policy  Committee 

2  shall  develop  and  maintain  an  Internet  website  on 

3  which  there  is  posted  information  that  includes  the 

4  following: 

5  "(A)  Established  governance  rules. 

6  "(B)  A  business  plan. 

7  "(C)  Meeting  notices  at  least  14  days  prior 

8  to  each  meeting. 

9  "(D)  Meeting  agendas  at  least  7  days  prior 

10  to  each  meeting. 

11  "(E)  Meeting  materials  at  least  3  days 

12  prior  to  each  meeting. 

13  "(c)  Membership. — 

14  "(1)  Appointments. — The  HIT  Policy  Com- 

15  mittee  shall  be  composed  of  members  to  be  ap- 

16  pointed  as  follows: 

17  "(A)  3  members  shall  be  appointed  by  the 

18  Secretary,  1  of  whom  shall  be  appointed  to  rep- 

19  resent  the  Department  of  Health  and  Human 

20  Services  and  1  of  whom  shall  be  a  public  health 

21  official. 

22  "(B)  1  member  shall  be  appointed  by  the 

23  majority  leader  of  the  Senate. 

24  "(C)  1  member  shall  be  appointed  by  the 

25  minority  leader  of  the  Senate. 
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1  "(D)  1  member  shall  be  appointed  by  the 

2  Speaker  of  the  House  of  Representatives. 

3  "(E)  1  member  shall  be  appointed  by  the 

4  minority  leader  of  the  House  of  Representa- 

5  tives. 

6  "(F)  Such  other  members  as  shall  be  ap- 

7  pointed  by  the  President  as  representatives  of 

8  other  relevant  Federal  agencies. 

9  "(G)  11  members  shall  be  appointed  by  the 

10  Comptroller  General  of  the  United  States  of 

1 1  whom — 

12  "(i)  -  1  member  shall  be  an  advocate 

13  for  patients  or  consumers; 

14  "(ii)  2  members  shall  represent  health 

15  care  providers,  one  of  which  shall  be  a  phy- 

16  sician; 

17  "(hi)  1  member  shall  be  from  a  labor 

18  organization    representing    health  care 

19  workers; 

20  "(iv)  1  member  shall  have  expertise  in 

21  privacy  and  security; 

22  "(v)  1  member  shall  have  expertise  in 

23  improving  the  health  of  vulnerable  popu- 

24  lations; 
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1  "(vi)  1  member  shall  be  from  the  re- 

2  search  community; 

3  "(vii)  1  member  shall  represent  health 

4  plans  or  other  third-party  payers; 

5  "(viii)  1  member  shall  represent  infor- 

6  mation  technology  vendors; 

7  u(ix)  1  member  shall  represent  pur- 

8  chasers  or  employers;  and 

9  "(x)  1  member  shall  have  expertise  in 

10  health  care  quality  measurement  and  re- 

1 1  porting. 

12  "(2)  National  coordinator. — The  National 

13  Coordinator  shall  be  a  member  of  the  HIT  Policy 

14  Committee  and  act  as  a  liaison  among  the  HIT  Pol- 

15  icy  Committee,  the  HIT  Standards  Committee,  and 

16  the  Federal  Government. 

17  "(3)  Chairperson  and  vice  chairperson. — 

18  The  HIT  Policy  Committee  shall  designate  1  mem- 

19  ber  to  serve  as  the  chairperson  and  1  member  to 

20  serve  as  the  vice  chairperson  of  the  HIT  Policy 

21  Committee. 

22  "(4)  Participation. — The  members  of  the 

23  HIT  Policy  Committee  appointed  under  paragraph 

24  (1)  shall  represent  a  balance  among  various  sectors 

25  of  the  health  care  system  so  that  no  single  sector 
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1  unduly   influences   the   recommendations   of  such 

2  Committee. 

3  "(5)  Terms.— 

4  "(A)  In  general. — The  terms  of  mem- 

5  bers  of  the  HIT  Policy  Committee  appointed 

6  under  paragraph  (1)  shall  be  3  years  except 
that  the  Comptroller  General  of  the  United 

8  States  shall  designate  staggered  terms  for  the 
members    first    appointed    under  paragraph 

10  (1)(G). 

11  "(B)  Vacancies. — Any  member  appointed 

12  to  fill  a  vacancy  in  the  membership  of  the  HIT 

13  Policy  Committee  that  occurs  prior  to  the  expi- 

14  ration  of  the  term  for  which  the  member's  pred- 

15  ecessor  was  appointed  shall  be  appointed  only 

16  for  the  remainder  of  that  term.  A  member  may 

17  serve  after  the  expiration  of  that  member's 

18  term  until  a  successor  has  been  appointed.  A 

19  vacancy  in  the  HIT  Policy  Committee  shall  be 

20  filled  in  the  manner  in  which  the  original  ap- 

21  pointment  was  made. 

22  "(6)  Outside  involvement. — The  HIT  Policy 

23  Committee  shall  ensure  an  adequate  opportunity  for 

24  the  participation  in  activities  of  the  Committee  of 

25  outside  advisors,  including  individuals  with  expertise 
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1  in  the  development  of  policies  for  the  electronic  ex- 

2  change  and  use  of  health  information,  including  in 

3  the  areas  of  health  information  privacy  and  security. 

4  "(7)  QUORUM.— Ten  members  of  the  HIT  Pol- 

5  icy  Committee  shall  constitute  a  quorum  for  pur- 

6  poses  of  voting,  but  a  lesser  number  of  members 

7  may  meet  and  hold  hearings. 

8  "(d)  Application  of  FACA. — The  Federal  Advisory 

9  Committee  Act  (5  U.S.C.  App.),  other  than  section  14  of 

10  such  Act,  shall  apply  to  the  HIT  Policy  Committee. 

11  "(e)  Publication. — The  Secretary  shall  provide  for 

12  publication  in  the  Federal  Register  and  the  posting  on  the 

13  Internet  website  of  the  Office  of  the  National  Coordinator 

14  for  Health  Information  Technology  of  all  policy  rec- 

15  ommendations  made  bv  the  HIT  Policv  Committee  under 

16  this  section. 

17  "SEC.  3003.  HIT  STANDARDS  COMMITTEE. 

18  "(a)  Establishment. — There  is  established  a  com- 

19  mittee  to  be  known  as  the  HIT  Standards  Committee  to 

20  recommend  to  the  National  Coordinator  standards,  imple- 

21  mentation  specifications,  and  certification  criteria  for  the 

22  electronic  exchange  and  use  of  health  information  for  pur- 

23  poses  of  adoption  under  section  3004(b),  consistent  with 

24  the  implementation  of  the  strategic  plan  described  in  sec- 

25  tion  3001(c)(3). 
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1  "(b)  Duties.— 

2  "(1)  Standard  development. — 

3  "(A)  In  GENERAL. — Beginning'  not  later 

4  than  1  year  after  the  date  of  the  enactment  of 

5  this  title,  the  HIT  Standards  Committee  shall 

6  recommend  to  the  National  Coordinator  stand- 

7  ards,  implementation  specifications,  and  certifi- 

8  cation  criteria  described  in  subsection  (a)  that 

9  have  been  developed,  harmonized,  or  recognized 

10  by  the   Committee.   Annually  thereafter  the 

11  Committee  shall  update  such  recommendations 

12  and  make  new  recommendations  as  appropriate, 

13  including'  in  response  to  a  notification  sent 

14  under  section  3004(b)(2).  Such  recommenda- 

15  tions  shall  be  consistent  with  the  latest  rec- 

16  ommendations  made  by  the  HIT  Policy  Com- 

17  mittee. 

18  "(B)  Pilot  testing  of  standards  and 

19  IMPLEMENTATION  SPECIFICATIONS. — 111  the  de- 

20  velopment,   harmonization,    or   recognition  of 

21  standards   and  implementation  specifications, 

22  the  HIT  Standards  Committee,  as  appropriate, 

23  shall  provide  for  the  testing  of  such  standards 

24  and  specifications  by  the  National  Institute  for 
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1  Standards  and  Technology  under  section  201  of 

2  the  PRO(TECH)T  Act  of  2008. 

3  "(C)  Consistency. — The  standards,  im- 

4  plementation   specifications,    and  certification 

5  criteria   recommended  under  this  subsection 

6  shall  be  consistent  with  the  standards  for  infor- 

7  mation  transactions  and  data  elements  adopted 

8  pursuant  to  section  1173  of  the  Social  Security 

9  Act. 

10  "(2)  FORUM.— The  HIT  Standards  Committee 

11  shall  serve  as  a  forum  for  the  participation  of  a 

12  broad  range  of  stakeholders  to  provide  input  on  the 

13  development,    harmonization,    and    recognition  of 

14  standards,  implementation  specifications,  and  certifi- 

15  cation  criteria  necessary  for  the  development  and 

16  adoption  of  a  nationwide  interoperable  health  infor- 

17  mation  technology  infrastructure. 

18  "(3)  Schedule. — Not  later  than  90  days  after 

19  the  date  of  the  enactment  of  this  title,  the  HIT 

20  Standards  Committee  shall  develop  a  schedule  for 

21  the  assessment  of  policy  recommendations  developed 

22  by  the  HIT  Policy  Committee  under  section  3002. 

23  The  HIT  Standards  Committee  shall  update  such 

24  schedule  annually.  The  Secretary  shall  publish  such 

25  schedule  in  the  Federal  Register. 
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1  "(4)    Public   input.— The   HIT  Standards 

2  Committee  shall  conduct  open  public  meetings  and 

3  develop  a  process  to  allow  for  public  comment  on  the 

4  schedule    described   in   paragraph    (3)    and  rec- 

5  ommendations  described  in  this  subsection.  Under 

6  such  process  comments  shall  be  submitted  in  a  time- 

7  ly  manner  after  the  date  of  publication  of  a  rec- 

8  ommendation  under  this  subsection. 

9  "(5)  Website.— The  HIT   Standards  Com- 

10  mittee   shall   develop   and   maintain   an  Internet 

1 1  website  on  which  there  is  posted  information  that  in- 

12  eludes  the  following: 

13  "(A)  Established  governance  rules. 

14  "(B)  A  business  plan. 

15  "(C)  Meeting  notices  at  least  14  days  prior 

16  to  each  meeting. 

17  "(D)  Meeting  agendas  at  least  7  days  prior 

18  to  each  meeting. 

19  "(E)  Meeting  materials  at  least  3  days 

20  prior  to  each  meeting. 

21  "(6)    Requirement    to    integrate  rec- 

22  OMMENDATIONS. — In   carrying   out   the  activities 

23  under  this  section,  the  HIT  Standards  Committee 

24  shall  integrate  the  recommendations  of  the  HIT  Pol- 

25  icy  Committee. 
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1  "(c)  Membership. — 

2  "(1)   Appointments. — The   HIT  Standards 

3  Committee  shall  be  composed  of  members  to  be  ap- 

4  pointed  as  follows: 

5  "(A)  2  members  shall  be  appointed  by  the 

6  Secretary. 

7  "(B)  1  member  shall  be  appointed  by  the 

8  majority  leader  of  the  Senate. 

9  "(C)  1  member  shall  be  appointed  by  the 

10  minority  leader  of  the  Senate. 

11  "(D)  1  member  shall  be  appointed  by  the 

12  Speaker  of  the  House  of  Representatives. 

13  "(E)  1  member  shall  be  appointed  by  the 

14  minority  leader  of  the  House  of  Representa- 

15  tives. 

16  "(F)  9  members  shall  be  appointed  by  the 

17  Comptroller  General  of  the  United  States  of 

1 8  whom — 

19  "(i)  1  member  shall  be  a  representa- 

20  tive  of  consumer  or  patient  organizations; 

21  "(ii)  1  member  shall  be  a  representa- 

22  tive  of  organizations  with  expertise  in  pri- 

23  vacy; 
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1  "(iii)  1  member  shall  be  a  representa- 

2  tive  of  organizations  with  expertise  in  secu- 

3  ritv; 

4  "(iv)  2  members  shall  be  a  representa- 

5  tive  of  health  care  providers,  one  of  which 

6  shall  be  a  physician; 

7  "(v)  1  member  shall  be  a  representa- 

8  tive  of  health  plans  or  other  third  party 

9  payers; 

10  "(vi)  1  member  shall  be  a  representa- 

1 1  tive  of  information  technology  vendors; 

12  '-(vii.)  1  member  shall  be  a  representa- 

13  tive  of  purchasers  or  employers;  and 

14  "(viii)  1  member  shall  be  a  represent- 

1 5  ative  of  the  health  research  community. 

16  "(G)  1  member  shall  be  appointed  by  the 

17  Director  of  the  National  Institute  for  Standards 

18  and  Technology. 

19  "(2)  National  coordinator. — The  National 

20  Coordinator  shall  be  a  member  of  the  HIT  Stand - 

21  ards  Committee  and  act  as  a  liaison  among  the  HIT 

22  Standards  Committee,  the  HIT  Policy  Committee, 

23  and  the  Federal  government. 

24  "(3)  Chairperson  and  vice  chairperson. — 

25  The  HIT  Standards  Committee  shall  designate  1 
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1  member  to  serve  as  the  chairperson  and  1  member 

2  to  serve  as  the  vice  chairperson  of  the  Committee. 

3  "(4)   Participation. — The  members  of  the 

4  HIT  Standards  Committee  appointed  under  para- 

5  graph  (1)  shall  represent  a  balance  among  various 

6  sectors  of  the  health  care  system  so  that  no  single 

7  sector  unduly  influences  the  recommendations  of 

8  such  Committee. 

9  "(5)  Terms.— 

10  "(A)  In  GENERAL. — The  terms  of  mem- 

1 1  bers  of  the  HIT  Standards  Committee  ap- 

12  pointed  under  paragraph  (1)  shall  be  3  years 

13  except  that  the  Comptroller  General  of  the 

14  United  States  shall  designate  staggered  terms 

15  for  the  members  first  appointed  under  para- 

16  '        graph  (1)(F). 

17  "(B)  Vacancies. — Any  member  appointed 

18  to  fill  a  vacancy  in  the  membership  of  the  HIT 

19  Standards  Committee  that  occurs  prior  to  the 

20  expiration  of  the  term  for  which  the  member's 

21  predecessor  was  appointed  shall  be  appointed 

22  only  for  the  remainder  of  that  term.  A  member 

23  may  serve  after  the  expiration  of  that  member's 

24  term  until  a  successor  has  been  appointed.  A 

25  vacancy  in  the  HIT  Standards  Committee  shall 
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1  be  filled  in  the  manner  in  which  the  original  ap- 

2  pointment  was  made. 

3  "(6)    Outside    involvement. — The  HIT 

4  Standards  Committee  shall  ensure  an  adequate  op- 

5  portunity  for  the  participation  in  activities  of  the 

6  Committee  of  outside  advisors,  including  individuals 
with  expertise  in  the  development  of  standards  for 

8  the  electronic  exchange  and  use  of  health  informa- 

9  tion,  including  in  the  areas  of  health  information 

10  privacy  and  security. 

11  "(7)  Quorum. — Eight  members  of  the  HIT 

12  Standards  Committee  shall  constitute  a  quorum  for 

13  purposes  of  voting,  but  a  lesser  number  of  members 

14  may  meet  and  hold  hearings. 

15  "(d)  Application  of  FACA. — The  Federal  Advisory 

16  Committee  Act  (5  U.S.C.  App.),  other  than  section  14, 

17  shall  apply  to  the  HIT  Standards  Committee. 

18  "(e)  Publication. — The  Secretary  shall  provide  for 

19  publication  in  the  Federal  Register  and  the  posting  on  the 

20  Internet  website  of  the  Office  of  the  National  Coordinator 

21  for  Health  Information  Technology  of  all  recommenda- 

22  tions  made  by  the  HIT  Standards  Committee  under  this 

23  section. 
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1  "SEC.  3004.  PROCESS  FOR  ADOPTION  OF  ENDORSED  REC- 

2  OMMEND  ATI  ONS. 

3  "(a)  Review  of  Endorsed  Standards,  Speci- 

4  fications,  and  Criteria. — Not  later  than  90  days  after 

5  the  date  of  receipt  of  standards,  implementation  specif ica- 

6  tions,  or  certification  criteria  endorsed  nnder  section 

7  3001(c),  the  Secretary,  in  consultation  with  representa- 

8  tives  of  other  relevant  Federal  agencies,  shall  jointly  re- 

9  view  such  standards,  specifications,  or  criteria  and  shall 

10  determine  whether  or  not  to  propose  adoption  of  snch 

1 1  standards,  specifications,  or  criteria. 


12  "(b)  Determination  to  Adopt  Standards,  Spec- 

13  ifications,  and  Criteria. — If  the  Secretary  deter- 

14  mines — 

15  "(1)  to  propose  adoption  of  any  grouping  of 

16  such  standards,  specifications,  or  criteria,  the  Sec- 

17  retary  shall,  through  a  rulemaking  process,  deter- 

18  mine  whether  or  not  to  adopt  such  grouping  of 

19  standards,  specifications,  or  criteria;  or 

20  "(2)  not  to  propose  adoption  of  any  grouping  of 

21  standards,  specifications,  or  criteria,  the  Secretary 

22  shall  notify  the  National  Coordinator  and  the  HIT 

23  Standards  Committee  in  writing  of  such  determina- 

24  tion  and  the  reasons  for  not  proposing  the  adoption 

25  of  such  recommendation. 


•HR  6357  IH 


33 

1  "(c)  Publication. — The  Secretary  shall  provide  for 

2  publication  in  the  Federal  Register  of  all  determinations 

3  made  by  the  Secretary  under  subsection  (a). 

4  "SEC.  3005.  APPLICATION  AND  USE  OF  ADOPTED  STAND- 

5  ARBS    AND    IMPLEMENTATION  SPECIFICA- 

6  TIONS  BY  FEDERAL  AGENCIES. 

7  "For  requirements  relating  to  the  application  and  use 

8  by  Federal  agencies  of  the  standards  and  implementation 

9  specifications  adopted  under  section  3004(b),  see  section 

10  111  of  the  PRO(TECH)T  Act  of  2008. 

1 1  "SEC.  3006.  VOLUNTARY  APPLICATION  AND  USE  OF  ADOPT- 

12  ED     STANDARDS     AND  IMPLEMENTATION 

1 3  SPECIFICATIONS  BY  PRD7ATE  ENTITIES. 

14  "(a)  In  General. — Except  as  provided  under  section 

15  112  of  the  PRO(TECH)T  Act  of  2008,  any  standard  or 

16  implementation    specification    adopted    under  section 

17  3004(b)  shall  be  voluntary  with  respect  to  private  entities. 

18  "(b)  Rule  of  Construction. — Nothing  in  this  sub- 

19  title  shall  be  construed  to  require  that  a  private  entity  that 

20  enters  into  a  contract  with  the  Federal  Government  apply 

21  or  use  the  standards  and  implementation  specifications 

22  adopted  under  section  3004(b)  with  respect  to  activities 

23  not  related  to  the  contract  . 
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1    "SEC.    3007.    HEALTH    INFORMATION    TECHNOLOGY  RE- 


2  SOURCE  CENTER. 

3  "(a)  Development. — 

4  "(1)  In  general. — The  National  Coordinator 

5  shall  develop  a  Health  Information  Technology  Re- 

6  source  Center  to  provide  technical  assistance  and  de- 

7  velop  best  practices  to  support  and  accelerate  efforts 

8  to  adopt,  implement,  and  effectively  use  health  infor- 

9  mation  technology  that  allows  for  the  electronic  ex- 

10  change  and  nse  of  information  in  compliance  with 

11  standards,  implementation  specifications,  and  certifi- 

12  cation  criteria  adopted  under  section  3004(b). 

13  "(2)  Purposes. — The  purpose  of  the  Center  is 

14  to— 

15  "(A)  provide  a  forum  for  the  exchange  of 

16  knowledge  and  experience; 

17  "(B)   accelerate  the  transfer  of  lessons 

18  learned  from  existing  public  and  private  sector 

19  initiatives,  including  those  currently  receiving 

20  Federal  financial  support; 

21  "(C)  assemble,  analyze,  and  widely  dis- 

22  seminate  evidence  and  experience  related  to  the 

23  adoption,  implementation,  and  effective  use  of 

24  health  information  technology  that  allows  for 

25  the  electronic  exchange  and  use  of  information; 
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1  "(D)  provide  technical  assistance  for  the 

2  establishment  and  evaluation  of  regional  and 

3  local  health  information  networks  to  facilitate 

4  the  electronic  exchange  of  information  across 

5  health  care  settings  and  improve  the  quality  of 

6  health  care; 

7  "(E)  provide  technical  assistance  for  the 

8  development  and  dissemination  of  solutions  to 

9  barriers  to  the  exchange  of  electronic  health  in- 

10  formation; 

11  "(F)  learn  about  effective  strategies  to 

12  adopt  and  utilize  health  information  technology 

13  in  medically  nnderserved  communities; 

14  "(G)  conduct  other  activities  identified  by 

15  the  States,  local  or  regional  health  information 

16  networks,  or  health  care  stakeholders  as  a  focus 

17  for  developing  and  sharing  best  practices;  and 

18  "(H)  provide  technical  assistance  to  pro- 

19  mote  adoption  and  utilization  of  health  informa- 

20  tion  technology  by  health  care  providers,  includ- 

21  ing  in  medically  underserved  communities. 

22  "(b)  Technical  Assistance  Telephone  Number 


23  OR  Website. — The  National  Coordinator  shall  establish 

24  a  toll-free  telephone  number  or  Internet  website  to  provide 

25  health  care  providers  with  a  single  point  of  contact  to — 
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1  "(1)  learn  about  Federal  grants  and  technical 
assistance  services  related  to  interoperable  health  in- 

3  formation  technology; 

4  "(2)   learn   about   standards,  implementation 

5  specifications,    and    certification    criteria  adopted 

6  under  section  3004(b); 

7  "(3)  learn  about  regional  and  local  health  infor- 

8  mation  networks  for  assistance  with  health  informa- 

9  tion  technology;  and 

10  "(4)  disseminate  additional  information  deter- 

11  mined  by  the  National  Coordinator.". 

12  SEC.  102.  TRANSITIONS. 

13  (a)  ONCHIT. — To  the  extent  consistent  with  section 


14  3001  of  the  Public  Health  Sendee  Act,  as  added  bv  section 

15  101,  all  functions,  personnel,  assets,  liabilities,  and  admin- 

16  istrative  actions  applicable  to  the  National  Coordinator  for 

17  Health  Information  Technology  appointed  under  Execu- 

18  tive  Order  13335  or  the  Office  of  such  National  Coordi- 

1 9  nator  on  the  date  before  the  date  of  the  enactment  of  this 

20  Act  shall  be  transferred  to  the  National  Coordinator  ap- 

21  pointed  under  section  3001(a)  of  such  Act  and  the  Office 

22  of  such  National  Coordinator  as  of  the  date  of  the  enact- 

23  ment  of  this  Act. 

24  (b)  AHIC.— 
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1  (1)  To  the  extent  consistent  with  sections  3002 

2  and  3003  of  the  Public  Health  Service  Act,  as  added 

3  by  section  101,  all  functions,  personnel,  assets,  and 

4  liabilities  applicable  to  the  American  Health  Infor- 

5  mation  Community  created  in  response  to  Executive 

6  Order  13335  as  of  the  day  before  the  date  of  the  en- 

7  actment  of  this  Act  shall  be  transferred  to  the  HIT 

8  Policy  Committee  or  the  HIT  Standards  Committee, 

9  established  under  section  3002(a)  or  3003(a)  of  such 

10  Act,  as  appropriate,  as  of  the  date  of  the  enactment 

1 1  of  this  Act. 

12  (2)  In  carrying  out  section  3003(b)(1)(A)  of  the 

13  Public  Health  Service  Act,  as  so  added,  until  rec- 

14  ommendations  are  made  by  the  HIT  Policy  Com- 

15  mittee,   recommendations  of  the  HIT  Standards 

16  Committee  shall  be  consistent  with  the  most  recent 

17  recommendations  made  by  the  American  Health  In- 

18  formation  Community. 

19  (c)  Rules  of  Construction. — 

20  (1)  ONCHIT.— Nothing-  in  section  3001  of  the 

21  Public  Health  Service  Act,  as  added  by  section  101, 

22  or  subsection  (a)  shall  be  construed  as  requiring  the 

23  creation  of  a  new  entity  to  the  extent  that  the  Office 

24  of  the  National  Coordinator  for  Health  Information 

25  Technology  established  pursuant  to  Executive  Order 
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1  13335  is  consistent  with  the  provisions  of  snch  sec- 

2  tion  3001. 

3  (2)  AHIC.— Nothing  in  sections  3002  or  3003 

4  of  the  Public  Health  Service  Act,  as  added  by  sec- 

5  tion  101,  or  subsection  (b)  shall  be  construed  as  re- 

6  quiring  the  creation  of  a  new  entity  to  the  extent 

7  that  the  American  Health  Information  Community 

8  created  in  response  to  Executive  Order  13335  is 

9  consistent  with  the  provisions  of  such  sections  3002 

10  and  3003. 

11  PART  II— APPLICATION  AND  USE  OF  ADOPTED 

12  HEALTH       INFORMATION  TECHNOLOGY 

13  STANDARDS;  REPORTS 

14  SEC.  111.  COORDINATION  OF  FEDERAL  ACTD7ITIES  WITH 

15  ADOPTED    STANDARDS   AND  IMPLEMENTA- 

16  TION  SPECIFICATIONS. 

17  (a)  Spending  on  Health  Information  Tech- 

18  nology  Systems. — As  each  agency  (as  defined  in  the  Ex- 

19  ecutive  Order  issued  on  August  22,  2006,  relating  to  pro- 

20  moting  quality  and  efficient  health  care  in  Federal  govern- 

21  merit  administered  or  sponsored  health  care  programs)  im- 

22  plements,  acquires,  or  upgrades  health  information  tech- 

23  nology  systems  used  for  the  direct  exchange  of  individually 

24  identifiable  health  information  between  agencies  and  with 

25  non-Federal  entities,  it  shall  utilize,  where  available, 
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1  health  information  technology  systems  and  products  that 

2  meet  standards  and  implementation  specifications  adopted 

3  under  section  3004(b)  of  the  Public  Health  Sendee  Act, 

4  as  added  by  section  101. 

5  (b)  Federal  Information  Collection  Activi- 

6  TIES. — With  respect  to  a  standard  or  implementation 

7  specification  adopted  under  section  3004(b)  of  the  Public 

8  Health  Sendee  Act,  as  added  by  section  101,  the  President 

9  shall  take  measures  to  ensure  that  Federal  activities  in- 

10  volving  the  broad  collection  and  submission  of  health  in- 

11  formation  are  consistent  with  such  standard  or  specifica- 

12  tion,  respectively,  within  three  years  after  the  date  of  such 

13  adoption. 

14  (c)  Application  of  Definitions. — The  definitions 

15  contained  in  section  3000  of  the  Public  Health  Service 

16  Act,  as  added  by  section  101,  shall  apply  for  purposes  of 

17  this  part. 

1 8  SEC.  112.  APPLICATION  TO  PRIVATE  ENTITIES. 

19  Each  agency  (as  defined  in  such  Executive  Order 

20  issued  on  August  22,  2006,  relating  to  promoting  quality 

21  and  efficient  health  care  in  Federal  government  adminis- 

22  tered  or  sponsored  health  care  programs)  shall  require  in 

23  contracts  or  agreements  with  health  care  providers,  health 

24  plans,  or  health  insurance  issuers  that  as  each  provider, 

25  plan,  or  issuer  implements,  acquires,  or  upgrades  health 
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1  information  technology  systems,  it  shall  utilize,  where 

2  available,  health  information  technology  systems  and  prod- 

3  nets  that  meet  standards  and  implementation  specifica- 

4  tions  adopted  under  section  3004(b)  of  the  Public  Health 

5  Service  Act.  as  added  by  section  101. 

6  SEC.  113.  REPORTS. 

7  (a)  In  General. — The  Secretary  of  Health  and 

8  Human  Sendees  shall  submit  to  the  Committee  on  Health, 

9  Education,  Labor,  and  Pensions  and  the  Committee  on 

10  Commerce,  Science,  and  Transportation  of  the  Senate  and 

11  the  Committee  on  Energy  and  Commerce  and  the  Com- 

12  mittee  on  Science  and  Technology  of  the  House  of  Rep- 

13  resentatives,  on  an  annual  basis,  a  report  that — 

14  (1)  describes  the  specific  actions  that  have  been 

15  taken  by  the  Federal  Government  and  private  enti- 

16  ties  to  facilitate  the  adoption  of  an  interoperable  na- 

1 7  tionwide  system  for  the  electronic  exchange  of  health 

1 8  information; 

19  (2)  describes  barriers  to  the  adoption  of  such  a 

20  nationwide  system:  and 

21  (3)  contains  recommendations  to  achieve  full 

22  implementation  of  such  a  nationwide  system. 

23  (b)  Redibursemext  Incentive  Study. — The  Sec- 

24  retary  of  Health  and  Human  Sendees  shall  carry  out,  or 

25  contract  with  a  private  entity  to  carry  out,  a  study  that 
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1  examines  methods  to  create  efficient  reimbursement  incen- 

2  tives  for  improving  health  care  quality  in  Federally  quali- 

3  fied  health  centers,  rural  health  clinics,  and  free  clinics. 

4  Subtitle  B — Incentives  for  the  Use 

5  of  Health  Information  Technology 

6  SEC.  121.  GRANT,  LOAN,  AND  DEMONSTRATION  PROGRAMS. 

7  Title  XXX  of  the  Public  Health  Service  Act,  as  added 

8  by  section  101,  is  amended  by  adding  at  the  end  the  fol- 

9  lowing  new  subtitle: 

io  "Subtitle  B — Incentives  for  the  Use 

n  of  Health  Information  Technology 

12  "SEC.  3011.  GRANTS  AND  LOANS  TO  FACILITATE  THE  WIDE- 

13  SPREAD  ADOPTION  OF  QUALIFIED  HEALTH 

14  INFORMATION  TECHNOLOGY. 

15  "(a)  Competitive  Grants  To  Facilitate  the 

16  Widespread  Adoption   of  Health  Information 

17  Technology. — 

18  "(1)  In  general. — The  National  Coordinator 

19  may  award  competitive  grants  to  eligible  entities  to 

20  purchase  qualified  health  information  technology. 

21  "(2)  Qualified  health  information  tech- 

22  NOLOGY. — For  purposes  of  this  section,  the  term 

23  'qualified    health    information   technology'  means 

24  health  information  technology  that  consists  of  hard- 
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1  ware,  software,  or  the  provision  of  support  services 

2  and  that — 

3  "(A)  enables  the  protection  of  health  infor- 

4  mation,  in  accordance  with  applicable  law; 

5  "(B)  is  (or  is  necessary  for  the  operation 

6  of)  an  electronic  health  records  system,  includ- 

7  ing  the  provision  of  decision  support  and  physi- 

8  cian  order  entry  for  medications; 

9  "(C)  has  the  ability  to  allow  timely  and 

10  permissible  access  to  patient  information  and  to 

11  transmit    and    exchange    health  information 

12  among-  providers,  patients,  or  insurers;  and 

13  "(D)  is  certified  under  the  program  devel- 

14  oped  under  section  3001(c)(9)  to  be  in  compli- 

15  ance  with  any  applicable  standards  and  imple- 

16  mentation  specifications  adopted  under  section 

17  3004(b). 

18  "(3)  Eligibility. — To  be  eligible  to  receive  a 

19  grant  under  paragraph  (1)  an  entity  shall — 

20  "(A)  submit  to  the  National  Coordinator 

21  an  application  at  such  time  and  in  such  manner 

22  as  the  National  Coordinator  may  require,  and 

23  containing — 

24  "(i)  a  plan  on  how  the  entity  intends 

25  to   maintain   and   support   the  qualified 
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1  health  information  technology  that  would 

2  be  purchased  Math  amounts  under  such 

3  grant,  including  the  type  of  resources  ex- 

4  pected  to  be  involved;  and 

5  "(ii)  such  other  information  as  the 

6  National  Coordinator  may  require; 

7  "(B)  submit  to  the  National  Coordinator  a 

8  strategic  plan  for  the  electronic  exchange  and 

9  use  of  health  information; 
10  "(C)  be- 
ll "(i)  a  not  for  profit  hospital  or  a  Fed- 

12  erally  qualified  health  center  (as  defined  in 

13  section  1861(aa)(4)  of  the  Social  Security 

14  Act); 

15  "(ii)  an  individual  or  group  practice; 

16  or 

17  "(hi)  another  health  care  provider  not 

18  described  in  clause  (i)  or  (ii); 

19  "(D)    demonstrate    significant  financial 

20  need; 

21  "(E)  agree  to  notify  individuals  in  accord- 

22  ance  with  section  302  of  the  PR()(TECH)T  Act 

23  of  2008  if  their  individually  identifiable  health 

24  information  is  accessed  or  acquired  as  a  r  esult 

25  of  a  breach;  and 
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1  "(F)  provide  matching  funds  in  accordance 

2  with  paragraph  (5). 

3  "(4)  USE  of  funds. — Amounts  received  under 

4  a  grant  under  this  subsection  shall  be  used  to  facili- 

5  tate  the  purchase  of  qualified  health  information 

6  technology. 

7  "(5)  Matching  requirement. — To  be  eligible 

8  for  a  grant  under  this  subsection  an  entity  shall  con- 

9  tribute  non-Federal  contributions  to  the  costs  of  car- 

10  rying  out  the  activities  for  which  the  grant  is  award- 

1 1  ed  in  an  amount  equal  to  $1  for  each  $3  of  Federal 

12  funds  provided  under  the  grant. 

13  "(6)  Preference  in  awarding  grants. — In 

14  awarding  grants  under  this  subsection  the  National 

15  Coordinator  shall  give  preference  to  the  following  eli- 

16  gible  entities: 

17  "(A)  Small  health  care  providers. 

18  "(B)  Entities  that  are  located  in  rural, 

19  frontier,  and  other  areas  that  serve  uninsured, 

20  underinsured,  and  medically  underserved  indi- 

21  viduals  (regardless  of  whether  such  area  is 

22  urban,  rural,  or  frontier). 

23  "(C)  Entities  that  will  link,  to  the  extent 

24  practicable,  to  local  or  regional  health  informa- 

25  tion  plan  or  plans. 
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1  "(D)  Nonprofit  health  care  providers. 

2  lt(7)  Additional  sources  op  funding  for 

3  HEALTH      INFORMATION      TECHNOLOGY. — Funding 

4  made  available  under  this  subsection  is  in  addition 

5  to  funding  which  may  be  used  toward  the  acquisition 

6  and  utilization   of  health   information  technology 

7  under  other  law,  which  includes  the  following: 

8  "(A)     Medicaid    transformation  grants 

9  under  section  1903(z)  of  the  Social  Security 

10  Act. 

11  "(B)  Grants  or  funding  available  through 

12  the  Agency  for  Healthcare  Research  and  Qual- 

13  ity. 

14  "(C)  Grants  or  funding  that  may  be  avail- 

15  able  through  the  Health  Resources  and  Services 

16  Administration  for  investment  in  health  infor- 

17  mation  technologies  or  telehealth. 

18  "(D)  Grants  or  funding  that  may  be  avail- 

19  able  through  the  Department  of  Agriculture's 

20  Rural  Development  Telecommunications  Pro- 

21  gram  for  investment  in  telemedicine. 

22  "(b)  Competitive  Grants  to  States  and  Indpan 


23  Tribes  for  the  Development  of  Loan  Programs  To 

24  Facilitate  the  Widespread  Adoption  of  Qualified 

25  Health  Information  Technology. — 
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1  "(1)  In  general. — The  National  Coordinator 

2  may  award  competitive  grants  to  eligible  entities  for 

3  the  establishment  of  programs  for  loans  to  health 

4  care  providers  to  purchase  qualified  health  informa- 

5  tion  technology. 

6  "(2)  Eligible  entity  defined. — For  pur- 

7  poses  of  this  subsection,  the  term  'eligible  entity' 

8  means  a  State  or  Indian  tribe  (as  defined  in  the  In- 

9  dian  Self-Determination  and  Education  Assistance 

10  Act)  that— 

11  "(A)  submits  to  the  National  Coordinator 

12  an  application  at  such  time,  in  such  manner, 

13  and  containing  such  information  as  the  Na- 

14  tional  Coordinator  may  require; 

15  "(B)  submits  to  the  National  Coordinator 

16  a  strategic  plan  in  accordance  with  paragraph 

17  (4)  and  provides  to  the  National  Coordinator 

1 8  assurances  that  the  entity  will  update  such  plan 

19  annually  in  accordance  with  such  paragraph; 

20  "(C)  provides  assurances  to  the  National 

21  Coordinator  that  the  entity  will  establish  a 

22  Loan  Fund  in  accordance  with  paragraph  (3); 

23  "(D)  provides  assurances  to  the  National 

24  Coordinator  that  the  entity  will  not  provide  a 

25  loan  from  the  Loan  Fund  to  a  health  care  pro- 
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1  vider  unless  the  provider  meets  each  of  the  con- 

2  ditions  described  in  paragraph  (5);  and 

3  "(E)  agrees  to  provide  matching  funds  in 

4  accordance  with  paragraph  (9). 

5  "(3)  Establishment  of  fund. — For  purposes 

6  of  paragraph  (3)(C),  an  eligible  entity  shall  establish 

7  a  qualified  health  information  technology  loan  fund 

8  (referred  to  in  this  subsection  as  a  'Loan  Fund') 

9  and  comply  with  the  other  requirements  contained  in 

10  this  section.  A  grant  to  an  eligible  entity  under  this 

11  subsection  shall  be  deposited  in  the  Loan  Fund  es- 

12  tablished  by  the  eligible  entity.  No  funds  authorized 

13  by  other  provisions  of  this  subtitle  to  be  used  for 

14  other  purposes  specified  in  this  subtitle  shall  be  de- 

15  posited  in  any  Loan  Fund. 

16  "(4)  Strategic  plan. — 

17  "(A)  In  general. — For  purposes  of  para- 

18  graph  (3)(B),  a  strategic  plan  of  an  eligible  en- 

19  tity  under  this  paragraph  shall  identify  the  in- 

20  tended  uses  of  amounts  available  to  the  Loan 

21  Fund  of  such  entity. 

22  "(B)  Contents. — A  strategic  plan  under 

23  subparagraph  (A),  with  respect  to  a  Loan  Fund 

24  of  an  eligible  entity,  shall  include  for  a  year  the 

25  following: 
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1  "(i)  A  list  of  the  projects  to  be  as- 

2  sisted  through  the  Loan  Fund  during  such 

3  year. 

4  "(ii)  A  description  of  the  criteria  and 

5  methods  established  for  the  distribution  of 

6  funds  from  the  Loan  Fund  during  the 

7  year. 

8  "(hi)  A  description  of  the  financial 

9  status  of  the  Loan  Fund  as  of  the  date  of 

10  submission  of  the  plan. 

11  "(iv)  The  short-term  and  long-term 

12  goals  of  the  Loan  Fund. 

13  "(5)  Health  care  provider  conditions  for 

14  RECEIPT  OF  LOANS. — For  purposes  of  paragraph 

15  (2)(D),  the  conditions  described  in  this  paragraph, 

16  with  respect  to  a  health  care  provider  that  seeks  a 

17  loan  from  a  Loan  Fund  established  under  this  sub- 

18  section,  are  the  following: 

19  "(A)  The  health  care  provider  links,  to  the 

20  extent  practicable,  to  a  local  or  regional  health 

21  information  network. 

22  "(B)  The  health  care  provider  consults 

23  with  the  Health  Information  Technology  Re- 

24  source  Center  established  under  section  3007  to 

25  access  the  knowledge  and  experience  of  existing 
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1  initiatives  regarding  the  successful  implementa- 

2  tio-n  and  effective  use  of  health  information 

3  technology. 

4  "(C)  The  health  care  provider  agrees  to 

5  notifv  individuals  in  accordance  with  section 

%.' 

6  302  of  the  PRO(TECH)T  Act  of  2008  if  their 

7  individually  identifiable  health  information  is 

8  accessed  or  acquired  as  a  result  of  a  breach. 

9  "(D)  The  health  care  provider  submits  to 

10  the  State  or  Indian  tribe  involved  a  plan  on  how 

11  the  health  care  provider  intends  to  maintain 

12  and  support  the  qualified  health  information 

13  technology  that  would  be  purchased  with  such 

14  loan,  including  the  type  of  resources  expected  to 

15  be  involved  and  any  such  other  information  as 

16  the  State  or  Indian  Tribe,  respectively,  may  re- 

17  quire. 

18  "(6)  Use  op  funds. — 

19  "(A)  In  general. — Amounts  deposited  in 

20  a  Loan  Fund,  including  loan  repayments  and 

21  interest  earned  on  such  amounts,  shall  be  used 

22  only  for  awarding  loans  or  loan  guarantees,  or 

23  as  a  source  of  reserve  and  security  for  leveraged 

24  loans,  the  proceeds  of  which  are  deposited  in 

25  the  Loan  Fund  established  under  paragraph 
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1  (1).  Loans  under  this  section  may  be  used  by 

2  a  health  care  provider  to  purchase  qualified 

3  health  information  technology. 

4  "(B)  Limitation. — Amounts  received  by 

5  an  eligible  entity  under  this  subsection  may  not 

6  be  used — 

7  "(i)  for  the  purchase  or  other  acquisi- 

8  tion  of  any  health  information  technology 

9  system  that  is  not  a  qualified  health  infor- 

10  mation  technology; 

11  "(ii)  to  conduct  activities  for  which 

12  Federal  funds  are  expended  under  this 

13  title;  or 

14  "(hi)  for  any  purpose  other  than  mak- 

15  ing  loans  to  health  care  providers  in  ae- 

16  cordance  with  this  section. 

17  "(7)  Types  of  assistance. — Except  as  other- 

18  wise  limited  by  applicable  State  law,  amounts  depos- 

19  ited  into  a  Loan  Fund  under  this  subsection  may 

20  only  be  used  for  the  following: 

21  "(A)  To  award  loans  that  comply  with  the 

22  following: 

23  "(i)  The  interest  rate  for  each  loan 

24  shall  not  exceed  the  market  interest  rate. 
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1  "(ii)  The  principal  and  interest  pay- 

2  ments  on  each  loan  shall  commence  not 

3  later  than  1  year  after  the  date  the  loan 

4  was  awarded,  and  each  loan  shall  be  fully 

5  amortized  not  later  than  10  years  after  the 

6  date  of  the  loan. 

7  "(in)  The  Loan  Fund  shall  be  cred- 

8  ited  with  all  payments  of  principal  and  in- 

9  terest  on  each  loan  awarded  from  the  Loan 

10  Fund. 

11  "(B)  To  guarantee,  or  purchase  insurance 

12  for,  a  local  obligation  (all  of  the  proceeds  of 

13  which  finance  a  project  eligible  for  assistance 

14  under  this  subsection)  if  the  guarantee  or  pur- 

15  chase  would  improve  credit  market  access  or  re- 

16  duce  the  interest  rate  applicable  to  the  obliga- 

17  tion  involved. 

18  "(C)  As  a  source  of  revenue  or  security  for 

19  the  payment  of  principal  and  interest  on  rev- 

20  enue  or  general  obligation  bonds  issued  by  the 

21  eligible  entity  if  the  proceeds  of  the  sale  of  the 

22  bonds  will  be  deposited  into  the  Loan  Fund. 

23  "(D)  To  earn  interest  on  the  amounts  de- 

24  posited  into  the  Loan  Fund. 

25  "(8)  Administration  of  loan  funds. — 
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1  "(A)  Combined  financial  administra- 

2  TION. — An  eligible  entity  may  (as  a  convenience 

3  and  to  avoid  unnecessary  administrative  costs) 

4  combine,  in  accordance  with  applicable  State 

5  law,  the  financial  administration  of  a  Loan 

6  Fund  established  under  this  subsection  with  the 

7  financial  administration  of  any  other  revolving 

8  fund  established  by  the  entity  if  otherwise  not 

9  prohibited  by  the  law  under  which  the  Loan 

10  Fund  was  established. 

11  "(B)  Cost  of  administering  fund. — 

12  Each  eligible  entity  may  annually  use  not  to  ex- 

13  ceed  4  percent  of  the  funds  provided  to  the  en- 

14  tity  under  a  grant  under  this  subsection  to  pay 

15  the  reasonable  costs  of  the  administration  of 

16  the  programs  under  this  section,  including  the 

17  recovery  of  reasonable  costs  expended  to  estab- 

18  lish  a  Loan  Fund  which  are  incurred  after  the 

19  date  of  the  enactment  of  this  title. 

20  "(C)  Guidance  and  regulations. — The 

21  National  Coordinator  shall  publish  guidance 

22  and  promulgate  regulations  as  may  be  nec- 

23  essary  to  carry  out  the  provisions  of  this  sub- 

24  section,  including — 
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1  "(i)  provisions  to  ensure  that  each  eli- 

2  gible  entity  commits  and  expends  funds  al- 

3  lotted  to  the  entity  under  this  subsection 

4  as  efficiently  as  possible  in  accordance  with 

5  this  title  and  applicable  State  laws;  and 

6  "(ii)  guidance  to  prevent  waste,  fraud, 

7  and  abuse. 

8  "(D)  Private  sector  contributions. — 

9  "(i)  In  general. — A  Loan  Fund  es- 

10  tablished  under  this  subsection  may  accept 

11  contributions  from  private  sector  entities, 

12  except  that  such  entities  may  not  specify 

13  the  recipient  or  recipients  of  any  loan 

14  issued  under  this  subsection.  An  eligible 

15  entity  may  agree  to  reimburse  a  private 

16  sector  entity  for  any  contribution  made 

17  under  this  subparagraph,  except  that  the 

18  amount  of  such  reimbursement  may  not  be 

19  greater  than  the  principal  amount  of  the 

20  contribution  made. 

21  "(ii)    Availability    of  informa- 

22  tion. — An  eligible  entity  shall  make  pub- 

23  licly  available  the  identity  of,  and  amount 

24  contributed  by,  any  private  sector  entity 

25  under  clause  (i)  and  may  issue  letters  of 
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1  commendation  or  make  other  awards  (that 

2  have  no  financial  value)  to  any  such  entity. 

3  "(9)  Matching  requirements. — 

4  "(A)  In  general. — The  National  Coordi- 

5  nator  may  not  make  a  grant  under  paragraph 

6  (1)  to  an  eligible  entity  unless  the  entity  agrees 

7  to  make  available  (directly  or  through  donations 

8  from  public  or  private  entities)  non-Federal 

9  contributions  in  cash  to  the  costs  of  carrying 

10  out  the  activities  for  which  the  grant  is  awarded 

1 1  in  an  amount  equal  to  not  less  than  $1  for  each 

12  $1  of  Federal  funds  provided  under  the  grant. 

13  "(B)  Determination  of  amount  of 

14  non-federal  contribution. — In  determining 

15  the  amount  of  non-Federal  contributions  that 

16  an  eligible  entity  has  provided  pursuant  to  sub- 

17  paragraph  (A),  the  National  Coordinator  may 

18  not  include  any  amounts  provided  to  the  entity 

19  by  the  Federal  Government. 

20  "(10)   Reports. — The   National  Coordinator 

21  shall  annually  submit  to  the  Committee  on  Health, 

22  Education,  Labor,  and  Pensions  and  the  Committee 

23  on  Finance  of  the  Senate,  and  the  Committee  on 

24  Energy  and  Commerce  of  the  House  of  Representa- 

25  tives,  a  report  summarizing  the  reports  received  by 
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1  the  National  Coordinator  from  each  eligible  entity 

2  that  receives  a  grant  under  this  subsection. 

3  "(c)  Competitive  Grants  for  the  Implementa- 

4  tion  of  Regional  or  Local  Health  Information 

5  Technology  Plans. — 

6  "(1)  In  general. — The  National  Coordinator 

7  may  award  competitive  grants  to  eligible  entities  to 

8  implement  regional  or  local  health  information  plans 

9  to  improve  health  care  quality  and  efficiency  through 

10  the  electronic  exchange  and  use  of  health  informa- 

1 1  tion. 

12  "(2)  Eligibility. — To  be  eligible  to  receive  a 

1 3  grant  under  paragraph  ( 1 )  an  entity  shall — 

14  "(A)  facilitate  the  electronic  exchange  and 

15  use  of  health  information  within  the  local  or  re- 

16  gional  area  and  among  local  and  regional  areas; 

17  "(B)  demonstrate  financial  need  to  the  Na- 

18  tional  Coordinator; 

19  "(C)  demonstrate  that  one  of  its  principal 

20  missions  or  purposes  is  to  use  information  tech- 

21  nology  to  improve  health  care  qualit}?'  and  effi- 

22  ciency; 

23  "(D)  adopt  bylaws,  memoranda  of  under- 

24  standing,  or  other  charter  documents  that  dem- 

25  onstrate  that  the  governance  structure  and  de- 
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1  cisionmaking  processes  of  such  entity  allow  for 

2  participation  on  an  ongoing-  basis  by  multiple 

3  stakeholders  within  a  community,  including — 

4  "(i)  physicians  (as  defined  in  section 

5  1861(r)  of  the  Social  Security  Act),  includ- 

6  ing  physicians  that  provide  services  to  low 

7  income  populations  and  populations  that 

8  are  uninsured,  underinsured,  and  medically 

9  underserved  (including  such  populations  in 

10  urban  and  rural  areas); 

11  "(ii)    hospitals    (including  hospitals 

12  that  provide  sendees  to  low  income  and  un- 

13  derserved  populations); 

14  "(hi)  pharmacists  and  pharmacies; 

15  "(iv)  health  plans; 

16  "(v)  health  centers  (as  defined  in  sec- 

17  tion  330(b))  and  Federally  qualified  health 

18  centers  (as  defined  in  section  1861(aa)(4) 

19  of  the  Social  Security  Act); 

20  "(vi)  rural  health  clinics  (as  defined  in 

21  section  1861(aa)  of  the  Social  Security 

22  Act); 

23  "(vii)  patient  or  consumer  organiza- 

24  tions  that  reflect  the  population  to  be 

25  served; 


•HR  6357  IH 


57 

1  "(viii)  employers; 

2  "(ix)  public  health  agencies;  and 

3  "(x)  snch  other  health  care  providers 

4  or  other  entities,  as  determined  appro- 

5  priate  by  the  National  Coordinator; 

6  "(E)  demonstrate  the  participation,  to  the 

7  extent  practicable,  of  stakeholders  in  the  elec- 

8  tronic  exchange  and  use  of  health  information 

9  within  the  local  or  regional  health  information 

10  plan  pursuant  to  subparagraph  (D); 

11  "(F)  adopt  nondiscrimination  and  conflict 

12  of  interest  policies  that  demonstrate  a  commit? 

13  ment  to  open,  fair,  and  nondiscriminatory  par- 

14  ticipation  in  the  regional  or  local  health  infor- 

15  mation  plan  by  all  stakeholders; 

16  "(G)  comply  with  applicable  standards  and 

17  implementation   specifications   adopted  under 

18  subtitle  A  of  this  title; 

19  "(H)  prepare  and  submit  to  the  National 

20  Coordinator  an  application  in  accordance  with 

21  paragraph  (3);  and 

22  "(I)  agree  to  provide  matching  funds  in  ac- 

23  cordance  with  paragraph  (6). 

24  "(3)  Application. — 
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1  "(A)  In  general. — To  be  eligible  to  re- 

2  ceive  a  grant  under  paragraph  (1),  an  entity 

3  shall  submit  to  the  National  Coordinator  an  ap- 

4  plication  at  such  time,  in  such  manner,  and 

5  containing  such  information  (in  addition  to  in- 

6  formation  required  under  subparagraph  (B),  as 

7  the  National  Coordinator  may  require. 

8  "(B)    Required    information. — At  a 

9  minimum,  an  application  submitted  under  this 

10  paragraph  shall  include — 

11  "(i)  clearly  identified  short-term  and 

12  long- term  objectives  of  the  regional  or  local 

13  health  information  plan; 

14  "(ii)  an  estimate  of  costs  of  the  hard- 

15  ware,  software,  training,  and  other  services 

16  necessary  to  implement  the  regional  or 

17  local  health  information  plan; 

18  "(hi)  a  strategy  that  includes  initia- 

19  tives  to  improve  health  care  quality  and  ef- 

20  ficiency; 

21  "(iv)  a  plan  that  describes  provisions 

22  to  encourage  the  electronic  exchange  and 

23  use  of  health  information  by  all  physicians, 

24  including  single  physician  practices  and 
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1  small  physician  groups,  participating  in  the 

2  health  information  plan; 

3  "(v)  a  plan  to  ensure  the  privacy  and 

4  security  of  individually  identifiable  health 

5  information  that  is  consistent  with  applica- 

6  ble  Federal  and  State  law; 

7  "(vi)  a  governance  plan  that  defines 

8  the  manner  in  which  the  stakeholders  shall 

9  jointly  make  policy  and  operational  deci- 

10  sions  on  an  ongoing  basis; 

11  "(vh)  a  financial  or  business  plan  that 

1 2  describes — 

13  "(I)    the    sustainability   of  the 

14  plan; 

15  "(II)  the  financial  costs  and  ben- 

16  efits  of  the  plan;  and 

17  "(III)  the  entities  to  which  such 

18  costs  and  benefits  will  accrue; 

19  "(viii)  a  plan  on  how  the  entity  in- 

20  volved  intends  to  maintain  and  support  the 

21  regional  or  local  health  information  plan, 

22  including  the  type  of  resources  expected  to 

23  be  involved;  and 

24  "(ix)  in  the  case  of  an  applicant  that 

25  is  unable  to  demonstrate  the  participation 
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1  of  all  stakeholders  pursuant  to  paragraph 

2  (2)(D),  the  justification  from  the  entity  for 

3  any  such  nonparticipation. 

4  "(4)  Use  of  funds. — Amounts  received  under 

5  a  grant  under  paragraph  (1)  shall  be  used  to  estab- 

6  lish  and  implement  a  regional  or  local  health  infor- 

7  mation  plan  in  accordance  with  this  subsection. 

8  "(5)  Preference. — In  awarding  grants  under 

9  paragraph  (1),  the  Secretary  shall  give  preference  to 

10  eligible  entities  that  intend  to  use  amounts  received 

11  under  a  grant  to  establish  or  implement  a  regional 

12  or  local  health  information  plan  that  encompasses 

13  communities  with  health  disparities  or  areas  that 

14  serve  uninsured,  underinsured,  and  medically  under- 

15  served  individuals  (including  urban  and  rural  areas). 

16  "(6)  Matching  requirement. — 

17  "(A)  In  general. — The  National  Coordi- 

18  nator  may  not  make  a  grant  under  this  sub- 

19  section  to  an  entity  unless  the  entity  agrees 

20  that,  with  respect  to  the  costs  of  carrying  out 

21  the  activities  for  which  the  grant  is  awarded, 

22  the   entity  will   make   available   (directly  or 

23  through  donations  from  public  or  private  enti- 

24  ties)   non-Federal  contributions  toward  such 

25  costs  in  an  amount  equal  to  not  less  than  50 
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1  percent  of  such  costs  ($1  for  each  $2  of  Federal 

2  funds  provided  under  the  grant). 

3  tl(B)  Determination  of  amount  con- 

4  tributed. — Non-Federal     contributions  re- 

5  quired  under  subparagraph  (A)  may  be  in  cash 

6  or  in  kind,  fairly  evaluated,  including  equip- 

7  ment,  technology,  or  services.  Amounts  provided 

8  by  the  Federal  Government,  or  services  assisted 

9  or  subsidized  to  any  significant  extent  by  the 

10  Federal  Government,  may  not  be  included  in 

11  determining  the  amount  of  such  non-Federal 

1 2  contributions . 

13  "(d)  Reports. — Not  later  than  1  year  after  the  date 


14  on  which  the  first  grant  is  awarded  under  this  section, 

15  and  annually  thereafter  during  the  grant  period,  an  entity 

16  that  receives  a  grant  under  this  section  shall  submit  to 

17  the  National  Coordinator  a  report  on  the  activities  carried 

18  out  under  the  grant  involved.  Each  such  report  shall  in- 

19  elude — 


20  "(1)  a  description  of  the  financial  costs  and 

21  benefits  of  the  project  involved  and  of  the  entities  to 

22  which  such  costs  and  benefits  accrue; 

23  "(2)  an  analysis  of  the  impact  of  the  project  on 

24  health  care  quality  and  safety; 
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1  "(3)  a  description  of  any  reduction  in  duplica- 

2  tive  or  unnecessary  care  as  a  result  of  the  project  in- 

3  volved; 

4  "(4)  a  description  of  the  efforts  of  recipients 

5  under  this  section  to  facilitate  secure  patient  access 

6  to  health  information; 

7  "(5)  an  analysis  of  the  effectiveness  of  the 

8  project  involved  on  ensuring  the  privacy  and  security 

9  of  individually  identifiable  health  information  in  ac- 

10  cordance  with  applicable  Federal  and  State  law;  and 

11  "(6)  other  information  as  required  by  the  Na- 

12  tional  Coordinator. 

13  "(e)  Requirement  To  Improve  Quality  of  Care 


14  and  Decrease  in  Costs. — The  National  Coordinator 

15  shall  annually  evaluate  the  activities  conducted  under  this 

16  section  and  shall,  in  awarding  grants,  implement  the  les- 

17  sons  learned  from  such  evaluation  in  a  manner  so  that 

1 8  awards  made  subsequent  to  each  such  evaluation  are  made 

19  in  a  manner  that,  in  the  determination  of  the  National 

20  Coordinator,  will  result  in  the  greatest  improvement  in 

21  quality  of  care  and  decrease  in  costs. 

22  "(f)  Limitation. — An  eligible  entity  may  only  receive 

23  one  non-renewable  grant  under  subsection  (a),  one  non- 
24  renewable  grant  under  subsection  (b),  and  one  non-renew- 
25  able  grant  under  subsection  (c). 
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1  "(g)  Small  Health  Care  Provider. — For  pur- 

2  poses  of  this  section,  the  term  'small  health  care  provider' 

3  means  a  health  care  provider  that  has  an  average  of  10 

4  or  fewer  full-time  equivalent  employees  during  the  period 

5  involved. 

6  "(h)  Authorization  of  Appropriations. — 

7  "(1)  In  general. — For  the  purpose  of  car- 

8  rying  out  subsections  (a)  through  (d),  there  is  au- 

9  thorized  to  be  appropriated  $115,000,000  for  each 

10  of  the  fiscal  years  2009  through  2013. 

11  "(2)    Availability. — Amounts  appropriated 

12  under  paragraph  (1)  shall  remain  available  through 

13  fiscal  year  2013. 

14  "SEC.  3012.  DEMONSTRATION  PROGRAM  TO  INTEGRATE  IN- 

15  FORMATION   TECHNOLOGY   INTO  CLINICAL 

16  EDUCATION. 

17  "(a)  In  General. — The  Secretary  may  award  grants 

18  under  this  section  to  carry  out  demonstration  projects  to 

19  develop  academic  curricula  integrating  qualified  health  in- 

20  formation  technology  in  the  clinical  education  of  health 

21  professionals.  Such  awards  shall  be  made  on  a  competitive 

22  basis  and  pursuant  to  peer  review. 

23  "(b)  Eligibility. — To  be  eligible  to  receive  a  grant 

24  under  subsection  (a),  an  entity  shall — 
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1  "(1)  submit  to  the  Secretary  an  application  at 

2  such  time,  in  such  manner,  and  containing  such  in- 

3  formation  as  the  Secretary  may  require; 

4  "(2)  submit  to  the  Secretary  a  strategic  plan 

5  for  integrating  qualified  health  information  tech- 

6  nology  in  the  clinical  education  of  health  profes- 

7  sionals  to  reduce  medical  errors  and  enhance  health 

8  care  quality; 

9  "(3)  be— 

10  "(A)   a   school  of  medicine,  osteopathic 

1 1  medicine,  dentistry,  or  pharmacy,  or  a  graduate 

12  program  in  behavioral  or  mental  health; 

13  "(B)  a  graduate  school  of  nursing  or  phy- 

14  sician  assistant  studies; 

15  "(C)  a  consortium  of  two  or  more  schools 

16  described  in  subparagraph  (A)  or  (B);  or 

17  "(D)  an  institution  with  a  graduate  med- 

18  ical  education  program  in  medicine,  osteopathic 

19  medicine,  dentistry,  pharmacy,  nursing,  or  phy- 

20  sician  assistance  studies. 

21  "(4)  provide  for  the  collection  of  data  regarding 

22  the  effectiveness  of  the  demonstration  project  to  be 

23  funded  under  the  grant  in  improving  the  safety  of 

24  patients,  the  efficiency  of  health  care  delivery,  and 

25  in  increasing  the  likelihood  that  graduates  of  the 
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1  grantee  will  adopt  and  incorporate  qualified  health 

2  information  technology,  in  the  delivery  of  health  care 

3  sendees;  and 

4  "(5)  provide  matching  funds  in  accordance  with 

5  subsection  (d). 

6  "(c)  Use  of  Funds. — 

7  "(1)  In  general. — With  respect  to  a  grant 

8  under  subsection  (a),  an  eligible  entity  shall — 

9  "(A)  use  grant  funds  in  collaboration  with 

10  2  or  more  disciplines;  and 

11  "(B)  use  grant  funds  to  integrate  qualified 

12  health  information  technology  into  community- 

13  based  clinical  education. 

14  "(2)  Limitation. — An  eligible  entity  shall  not 

15  use  amounts  received  under  a  grant  under  sub- 

16  section  (a)  to  purchase  hardware,  software,  or  serv- 

17  ices. 

18  "(d)  Matching  Funds. — 

19  "(1)  In  general. — The  Secretary  may  award 

20  a  grant  to  an  entity  under  this  section  only  if  the 

21  entity  agrees  to  make  available  non-Federal  con- 

22  tributions  toward  the  costs  of  the  program  to  be 

23  funded  under  the  grant  in  an  amount  that  is  not 

24  less  than  $1  for  each  $2  of  Federal  funds  provided 

25  under  the  grant. 
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1  "(2)  Determination  of  amount  contrib- 

2  uted. — Non-Federal  contributions  under  paragraph 

3  (1)  may  be  in  cash  or  in  kind,  fairly  evaluated,  in- 

4  eluding  equipment  or  services.  Amounts  provided  by 

5  the  Federal  Government,  or  services  assisted  or  sub- 

6  sidized  to  any  significant  extent  by  the  Federal  Gov- 

7  ernment,  may  not  be  included  in  determining  the 

8  amount  of  such  contributions. 

9  "(e)  Evaluation. — The  Secretary  shall  take  such 


10  action  as  may  be  necessary  to  evaluate  the  projects  funded 

11  under  this  section  and  publish,  make  available,  and  dis- 

1 2  seminate  the  results  of  such  evaluations  on  as  wide  a  basis 

13  as  is  practicable. 

14  "(f)  REPORTS. — Not  later  than  1  year  after  the  date 

15  of  enactment  of  this  title,  and  annually  thereafter,  the  Sec- 

16  retary  shall  submit  to  the  Committee  on  Health,  Edu- 

17  cation,  Labor,  and  Pensions  and  the  Committee  on  Fi- 

18  nance  of  the  Senate,  and  the  Committee  on  Energy  and 

19  Commerce  of  the  House  of  Representatives  a  report 

20  that— 


21  "(1)  describes  the  specific  projects  established 

22  under  this  section;  and 

23  "(2)  contains  recommendations  for  Congress 

24  based  on  the  evaluation  conducted  under  subsection 

25  (e). 
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1  tl(g')  Authorization  of  Appropriations. — There 

2  is  authorized  to  be  appropriated  to  carry  out  this  section, 

3  $10,000,000  for  each  of  fiscal  years  2009  through  2011. 

4  "(h)  Sunset. — This  section  shall  not  apply  after 

5  September  30,  2011.". 

6  TITLE  II— TESTING  OF  HEALTH 

7  INFORMATION  TECHNOLOGY 

8  SEC.  201.  NATIONAL  INSTITUTE   FOR  STANDARDS  AND 

9  TECHNOLOGY  TESTING. 

10  (a)  Pilot  Testing  of  Standards  and  Implemen- 

11  tation  Specifications. — In  coordination  with  the  HIT 

12  Standards  Committee  established  under  section  3003  of 

13  the  Public  Health  Service  Act,  as  added  by  section  101, 

14  with  respect  to  the  development  of  standards  and  imple- 

15  mentation  specifications  under  such  section,  the  Director 

16  of  the  National  Institute  for  Standards  and  Technology 

17  shall  test  such  standards  and  specifications  in  order  to  as- 

18  sure  the  efficient  implementation  and  use  of  such  stand- 

19  ards  and  specifications. 

20  (b)  Voluntary  Testing  Program. — In  coordina- 

2 1  tion  with  the  HIT  Standards  Committee  established  under 

22  section  3003  of  the  Public  Health  Service  Act,  as  added 

23  by  section  101,  with  respect  to  the  development  of  stand- 

24  ards  and  implementation  specifications  under  such  sec- 

25  tion,  the  Director  of  the  National  Institute  of  Standards 
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1  and  Technology  shall  support  the  establishment  of  a  con- 

2  formance  testing  infrastructure,  including-  the  develop- 

3  ment  of  technical  test  beds.  The  development  of  this  con- 

4  formance  testing  infrastructure  may  include  a  program  to 

5  accredit  independent,  non-Federal  laboratories  to  perform 

6  testing. 

7  SEC.  202.  RESEARCH  AND  DEVELOPMENT  PROGRAMS. 


8  (a)  Health  Care  Information  Enterprise  Inte- 

9  oration  Research  Centers. — 

10  (1)  In  general. — The  Director  of  the  National 

1 1  Institute  of  Standards  and  Technology,  in  consulta- 

12  tion  the  Director  of  the  National  Science  Foundation 

13  and  other  appropriate  Federal  agencies,  shall  estab- 

14  lish  a  program  of  assistance  to  institutions  of  higher 

15  education  (or  consortia  thereof  which  may  include 

16  nonprofit  entities  and  Federal  Government  labora- 

17  tories)   to  establish  multidisciplinary  Centers  for 

18  Health  Care  Information  Enterprise  Integration. 

19  (2)  Review;  competition. — Grants  shall  be 

20  awarded  under  this  subsection  on  a  merit-reviewed, 

21  competitive  basis. 

22  (3)  PURPOSE. — The  purposes  of  the  Centers  de- 

23  scribed  in  paragraph  (1)  shall  be — 

24  (A)  to  generate  innovative  approaches  to 

25  health  care  information  enterprise  integration 
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1  by  conducting"   cutting-edge,  multidisciplinary 

2  research  on  the  systems  challenges  to  health 

3  care  delivery;  and 

4  (B)  the  development  and  use  of  health  in- 

5  formation  technologies  and  other  complemen- 

6  tary  fields. 

7  (4)  Research  areas. — Research  areas  may  in- 

8  elude — 

9  (A)  interfaces  between  human  information 

10  and  communications  technology  systems; 

11  (B)  voice-recognition  systems; 

12  (C)  software  that  improves  interoperability 

13  and  connectivity  among  health  information  sys- 

14  terns; 

15  (D)  software  dependability  in  systems  crit- 

16  ical  to  health  care  delivery; 

17  (E)  measurement  of  the  impact  of  informa- 

18  tion  technologies  on  the  quality  and  productivity 

19  of  health  care; 

20  (F)  health  information  enterprise  manage- 

21  ment; 

22  (G)  health  information  technology  security 

23  and  integrity;  and 

24  (H)  relevant  health  information  technology 

25  to  reduce  medical  errors. 
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1  (5)  Applications. — An  institution  of  higher 

2  education  (or  a  consortium  thereof)  seeking  funding 

3  under  this  subsection  shall  submit  an  application  to 

4  the  Director  of  the  National  Institute  of  Standards 

5  and  Technology  at  such  time,  in  such  manner,  and 

6  containing  such  information  as  the  Director  may  re- 

7  quire.  The  application  shall  include,  at  a  minimum, 

8  a  description  of — 

9  (A)  the  research  projects  that  -will  be  un- 

10  dertaken  by  the  Center  established  pursuant  to 

11  assistance  under  paragraph  (1)  and  the  respec- 

12  tive  contributions  of  the  participating  entities; 

13  (B)  how  the  Center  will  promote  active  col- 

14  laboration  among  scientists  and  engineers  from 

15  different  disciplines,  such  as  information  tech- 

16  nology,  biologic  sciences,  management,  social 

17  sciences,  and  other  appropriate  disciplines; 

18  (C)  technology  transfer  activities  to  dem- 

19  onstrate  and  diffuse  the  research  results,  tech- 

20  nologies,  and  knowledge;  and 

21  (D)  how  the  Center  will  contribute  to  the 

22  education  and  training  of  researchers  and  other 

23  professionals  in  fields  relevant  to  health  infor- 

24  mation  enterprise  integration. 
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1  (b)   National  Information  Technology  Re- 

2  search  and  Development  Program. — The  National 

3  High-Performance  Computing'  Program  established  by 

4  section  101  of  the  High-Performance  Computing  Act  of 

5  1991  (15  U.S.C.  5511)  shall  coordinate  Federal  research 

6  and  development  programs  related  to  the  development  and 

7  deployment  of  health  information  technology,  including  ac- 

8  tivities  related  to — 


9  (1)  computer  infrastructure; 

10  (2)  data  security; 

11  (3)  development  of  large-scale,  distributed,  reli- 

12  able  computing  systems; 

13  (4)  wired,  wireless,  and  hybrid  high-speed  net- 

14  working; 

15  (5)  development  of  software  and  software-inten- 

16  sive  systems; 

17  (6)  human-computer  interaction  and  informa- 

18  tion  management  technologies;  and 

19  (7)  the  social  and  economic  implications  of  in- 

20  formation  technology. 

21  TITLE  III— PRIVACY  AND 

22  SECURITY  PROVISIONS 

23  SEC.  300.  DEFINITIONS. 

24  In  this  title,  except  as  specified  otherwise: 
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1  (1)  Breach. — The  term  "breach"  means  the 

2  unauthorized  acquisition  or  disclosure  of  protected 

3  health  information  which  compromises  the  security, 

4  privacy,  or  integrity  of  protected  health  information 

5  maintained  by  or  on  behalf  of  a  person.  Such  term 

6  does  not  include  any  unintentional  acquisition  of 

7  such  information  by  an  employee  or  agent  of  the 

8  covered  entity  or  business  associate  involved  if  such 

9  acquisition  was  made  in  good  faith  and  within  the 

10  course  and  scope  of  the  employment  or  other  con- 

11  tractual  relationship  of  such  employee  or  agent,  re- 

12  spectively,  with  the  covered  entity  or  business  asso- 

13  ciate  and  if  such  information  is  not  further  acquired, 

14  used,  or  disclosed  by  such  employee  or  agent. 

15  (2)  Business  associate. — The  term  "business 

16  associate"  has  the  meaning  given  such  term  in  sec- 

17  tion  160.103  of  title  45,  Code  of  Federal  Regula- 

18  tions. 

19  (3)  Covered  entity. — The  term  "covered  en- 

20  tity"  has  the  meaning  given  such  term  in  section 

21  160.103  of  title  45,  Code  of  Federal  Regulations. 

22  (4)  Disclose. — The  terms  "disclose"  and  "dis- 

23  closure"  have  the  meaning  given  the  term  "disclo- 

24  sure"  in  section  160.103  of  title  45,  Code  of  Federal 

25  Regulations. 
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1  (5)  Encryption. — The  term  "encryption"  has 

2  the  meaning'  given  such  term  in  section  164.304  of 

3  title  45,  Code  of  Federal  Regulations. 

4  (6)  Health  care  operations. — The  term 

5  "health  care  operation"  has  the  meaning  given  such 

6  term  in  section  164.501  of  title  45,  Code  of  Federal 

7  Regulations. 

8  (7)    Health    care    provider. — The  term 

9  "health  care  provider"  has  the  meaning  given  such 

10  term  in  section  160.103  of  title  45,  Code  of  Federal 

1 1  Regulations. 

12  (8)  Personal  health  record. — The  term 

13  "personal  health  record"  means  an  electronic  record 

14  of  individually  identifiable  health  information  on  an 

15  individual  that  is  drawn  from  multiple  sources  and 

16  that  is  managed,  shared,  and  controlled  by  or  for  the 

17  individual. 

18  (9)  Protected  health  information. — The 

19  term  "protected  health  information"  has  the  mean- 

20  ing  given  such  term  under  section  160.103  of  title 

21  45,  Code  of  Federal  Regulations. 

22  (10)     Secretary. — The    term  "Secretary" 

23  means  the  Secretary  of  Health  and  Human  Services. 
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1  (11)  Security. — The  term  "  security"  has  the 

2  meaning  given  such  term  in  section  164.304  of  title 

3  45,  Code  of  Federal  Regulations. 

4  (12)  State. — The  term  "State"  means  each  of 

5  the  several  States,  the  District  of  Columbia,  Puerto 

6  Rico,  the  Virgin  Islands,  Guam,  American  Samoa, 

7  and  the  Northern  Mariana  Islands. 

8  (13)  Use. — The  term  "use"  has  the  meaning 

9  given  such  term  in  section  160.103  of  title  45,  Code 

10  of  Federal  Regulations. 

11  (14)     Vendor     of     personal  health 

12  RECORDS. — The  term  "vendor"  means  an  entity  that 

13  offers  or  maintains  a  personal  health  record  and 

14  that  is  not  a  covered  entity. 

15  Subtitle  A — Security  Provisions 

16  SEC.  301.  APPLICATION  OF  SECURITY  PROVISIONS  AND 

17  PENALTIES   TO   BUSINESS  ASSOCIATES  OF 

18  COVERED  ENTITIES;  ANNUAL  GUIDANCE  ON 

19  SECURITY  PROVISIONS. 

20  (a)  Application  of  Security  Provisions. — Sec- 

21  tions  164.308,  164.310,  and  164.312  of  title  45,  Code  of 

22  Federal  Regulations,  shall  apply  to  a  business  associate 

23  of  a  covered  entity  in  the  same  manner  that  such  sections 

24  apply  to  the  covered  entity. 
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1  (b)  Application  op  Civil  and  Criminal  Pen- 

2  alties. — Sections  1176  and  1177  of  the  Social  Security 

3  Act  (42  U.S.C.  1320d-5,  1320d-6)  shall  apply  to  a  busi- 

4  ness  associate  of  a  covered  entity  with  respect  to  a  section 

5  applied  under  subsection  (a)  to  such  business  associate  in 

6  the  same  manner  that  such  sections  apply  to  a  covered 

7  entity  with  respect  to  such  section. 

8  (c)  Annual  Guidance. — For  the  first  year  begin- 

9  ning  after  the  date  of  the  enactment  of  this  Act  and  annu- 

10  ally  thereafter,  the  Secretary  of  Health  and  Human  Serv- 

1 1  ices  shall,  in  consultation  with  industry  stakeholders,  an- 

12  nually  issue  guidance  on  the  latest  safeguard  technologies 

13  for  use  in  carrying  out  the  sections  described  in  subsection 

14  (a). 

15  SEC.  302.  NOTIFICATION  IN  THE  CASE  OF  BREACH. 

16  (a)  In  General. — A  covered  entity  that  accesses, 

17  maintains,  retains,  modifies,  records,  stores,  destroys,  or 

18  otherwise  holds,  uses,  or  discloses  unencrypted  protected 

19  health  information  (as  defined  in  subsection  (h))  shall,  in 

20  the  case  of  a  breach  of  such  information  that  is  discovered 

21  by  the  covered  entity,   notify  each  individual  whose 

22  unencrypted  protected  health  information  has  been,  or  is 

23  reasonably  believed  by  the  covered  entity  to  have  been, 

24  accessed  or  acquired  as  a  result  of  such  breach. 
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1  (b)  Notification  of  Covered  Entity  by  Busi- 

2  ness  Associate. — A  business  associate  of  a  covered  enti- 

3  ty  that  accesses,  maintains,  retains,  modifies,  records, 

4  stores,  destroys,  or  otherwise  holds,  uses,  or  discloses 

5  unencrypted  protected  health  information  shall,  following 

6  the  discovery  of  a  breach  of  such  information,  notify  the 

7  covered  entity  of  such  breach.  Such  notice  shall  include 

8  the  identification  of  each  individual  whose  unencrypted 

9  protected  health  information  has  been,  or  is  reasonably  be- 

10  lieved  to  have  been,  accessed  or  acquired  during  such 

1 1  breach. 

12  (c)  Breaches  Treated  as  Discovered. — For  pur- 

13  poses  of  this  section,  a  breach  shall  be  treated  as  discov- 

14  ered  by  a  covered  entity  or  by  a  business  associate  as  of 

15  the  first  day  on  which  such  breach  is  known  to  such  entity 

16  or  associate,  respectively,  (including  any  person  that  is  an 

17  employee,  officer,  or  other  agent  of  such  entity  or  asso- 

18  ciate,  respectively)  or  should  reasonably  have  been  known 

19  to  such  entity  or  associate  (or  person)  to  have  occurred. 

20  (d)  Timeliness  of  Notification. — 

21  (1)  In  general. — All  notifications  required 

22  under  this  section  shall  be  made  without  unreason- 

23  able  delay  and  in  no  case  later  than  60  calendar 

24  days  after  the  discovery  of  a  breach  by  the  covered 
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1  entity  involved  (or  business  associate  involved  in  the 

2  ease  of  a  notification  required  under  subsection  (b)). 

3  (2)  Burden  of  proof. — The  covered  entity  in- 

4  volved  (or  business  associate  involved  in  the  case  of 

5  a  notification  required  under  subsection  (b)),  shall 

6  have  the  burden  of  demonstrating-  that  all  notifica- 

7  tions  were  made  as  required  under  this  subtitle,  in- 

8  eluding  evidence  demonstrating  the  necessity  of  any 

9  delay. 

10  (e)  Methods  of  Notice. — 

11  (1)    Individual    notice. — Notice  required 

12  under  this  section  to  be  provided  to  an  individual, 

13  with  respect  to  a  breach,  shall  be  provided  promptly 

14  and  in  the  following  form: 

15  (A)  Written  notification  by  first-class  mail 

16  to  the  individual  (or  the  next  of  kin  of  the  indi- 

17  vidual  if  the  individual  is  deceased)  at  the  last 

18  known  address  of  the  individual  or  the  next  of 

19  kin,  respectively,  or,  if  specified  as  a  preference 

20  by  the  individual,  by  electronic  mail.  The  notifi- 

21  cation  may  be  provided  in  one  or  more  mailings 

22  as  information  is  available. 

23  (B)  In  the  case  where  there  is  insufficient, 

24  or  out-of-date  contact  information  that  pre- 

25  eludes  direct  written  (or,  if  specified  by  the  in- 
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1  dividual  under  subparagraph  (A),  electronic) 

2  notification  to  the  individual,  a  substitute  form 

3  of  notice  shall  be  provided,  including  a  con- 

4  spicuous  posting-  on  the  home  page  of  the  Web 

5  site  of  the  covered  entity  involved  or  notice  in 

6  major   print   or   broadcast   media,  including 

7  major  media  in  geographic  areas  where  the  in- 

8  dividuals  affected  by  the  breach  likely  reside. 

9  Such  a  notice  in  media  will  include  a  toll-free 

10  phone  number  where  an  individual  can  learn 

11  whether  or  not  the  individual's  unencrypted 

12  protected  health  information  is  possibly  in- 

13  eluded  in  the  breach. 

14  (C)  In  any  case  deemed  by  the  covered  en- 

15  tity  involved  to  require  urgency  because  of  pos- 

16  sible  imminent  misuse  of  unencrypted  protected 

17  health  information,  the  covered  entity,  in  addi- 

18  tion  to  notice  provided  under  subparagraph  (A), 

19  may  provide  information  to  individuals  by  tele- 

20  phone  or  other  means,  as  appropriate. 

21  (2)  Media  notice. — Notice  shall  be  provided 

22  to  prominent  media  outlets  serving  a  State  or  juris- 

23  diction,  following  the  discovery  of  a  breach  described 

24  in   subsection   (a),   if  the  unencrypted  protected 

25  health  information  of  more  than  500  residents  of 
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1  such  State  or  jurisdiction  is,  or  is  reasonably  be- 

2  lieved  to  have  been,  accessed  or  acquired  during 

3  such  breach. 

4  (3)  Notice  to  secretary. — Notice  shall  be 

5  provided  to  the  Secretary  by  covered  entities  of 

6  unencrypted  protected  health  information  that  has 

7  been  acquired  or  disclosed  in  a  breach. 

8  (4)  Posting  on  hhs  public  website. — The 
Secretary  shall  make  available  to  the  public  on  the 

10  Internet  website  of  the  Department  of  Health  and 

11  Human  Services  a  list  that  identifies  each  covered 

12  entity  involved  in  a  breach  described  in  subsection 

13  (a)  in  which  the  unencrypted  protected  health  infor- 

14  mation  of  more  than  1,000  individuals  is  acquired  or 

15  disclosed. 

16  (f)  Content  op  Notification. — Regardless  of  the 

17  method  by  which  notice  is  provided  to  individuals  under 

18  this  section,  notice  of  a  breach  shall  include,  to  the  extent 

19  possible,  the  following': 

20  (1)  A  brief  description  of  what  happened,  in- 

21  eluding  the  date  of  the  breach  and  the  date  of  the 

22  discovery  of  the  breach,  if  known. 

23  (2)  A  description  of  the  types  of  unencrypted 

24  protected  health  information  that  were  involved  in 

25  the  breach  (such  as  full  name,  Social  Security  num- 
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1  ber,  date  of  birth,  home  address,  account  number,  or 

2  disability  code). 

3  (3)  The  steps  individuals  should  take  to  protect 

4  themselves  from  potential  harm  resulting  from  the 

5  breach. 

6  (4)  A  brief  description  of  what  the  covered  enti- 

7  ty  involved  is  doing  to  investigate  the  breach,  to 

8  mitigate  losses,  and  to  protect  against  any  further 

9  breaches. 

10  (5)  Contact  procedures  for  individuals  to  ask 

1 1  questions  or  learn  additional  information,  which 

12  shall  include  a  toll-free  telephone  number,  an  e-mail 

13  address,  Web  site,  or  postal  address. 

14  (g)  Delay  of  Notification  Authorized  for  Law 


15  Enforcement  Purposes. — If  a  law  enforcement  official 

16  determines  that  a  notification,  notice,  or  posting  required 

17  under  this  section  would  impede  a  criminal  investigation 

18  or  cause  damage  to  national  security,  such  notification, 

19  notice,  or  posting  shall  be  delayed  in  the  same  manner 

20  as  provided  under  section  164.528(a)(2)  of  title  45,  Code 

21  of  Federal  Regulations,  in  the  case  of  a  disclosure  covered 

22  under  such  section. 

23  (h)  Unencrypted  Protected  Health  Informa- 

24  tion  Defined. — For  purposes  of  this  section,  the  term 

•HR  6357  IH 


81 

1  "unencrypted  protected  health  information"  means  pro- 

2  tected  health  information  that  is  not  protected — 

3  (1)  through  the  use  of  encryption;  or 

4  (2)  through  the  use  of  a  technology  specified  by 

5  the  Secretary  as  being  at  least  as  effective  as 

6  encryption   for   purposes   of   rendering  protected 

7  health  information  indecipherable  without  authoriza- 

8  tion. 

9  SEC.  303.  EDUCATION  ON  HEALTH  INFORMATION  PRIVACY 

1 0  AND  REPORT  ON  COMPLIANCE. 

11  (a)  Regional  Office  Privacy  Advisors. — Not 

12  later  than  6  months  after  the  date  of  the  enactment  of 

13  this  Act,  the  Secretary  shall  designate  an  individual  in 

14  each  regional  office  of  the  Department  of  Health  and 

15  Human  Services  to  offer  guidance  and  education  to  cov- 

16  ered  entities,  business  associates,  and  individuals  on  their 

17  rights  and  responsibilities  related  to  Federal  privacy  re- 

18  quirements  for  protected  health  information. 

19  (b)  Report  on  Compliance. — 

20  (1)  In  general. — For  the  first  year  beginning 

21  after  the  date  of  the  enactment  of  this  Act  and  an- 

22  nually  thereafter,  the  Secretary  shall  prepare  and 

23  submit  to  Congress  a  report  concerning  complaints 

24  of  alleged  violations  of  the  provisions  of  sections  301 

25  and  302,  the  provisions  of  subtitle  B,  and  the  provi- 
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1  sions  of  subparts  C  and  E  of  title  45,  Code  of  Fed- 

2  eral  Regulations  that  are  received  by  the  Secretary 

3  during  the  year  for  which  the  report  is  being  pre- 

4  pared.  Each  such  report  shall  include,  with  respect 

5  to  such  complaints  received  during  the  year- — 

6  (A)  the  number  of  such  complaints; 

7  (B)  the  resolution  or  disposition  of  such 

8  complaints; 

9  (C)  the  amount  of  civil  money  penalties 

10  imposed  Avith  respect  to  such  complaints,  as  ap- 

1 1  plicable; 

12  (D)  the  number  of  compliance  reviews  con- 

13  ducted  and  the  outcome  of  each  such  review; 

14  (E)  the  number  of  subpoenas  or  inquiries 

15  issued;  and 

16  (P)  the  Secretary's  plan  for  improving 

17  compliance  with  and  enforcement  of  such  provi- 

1 8  sions  for  the  following  year. 

19  (2)  Availability  to  public. — Each  report 

20  under  paragraph  (1)  shall  be  made  available  to  the 

21  public  on  the  Internet  website  of  the  Department  of 

22  Health  and  Human  Sen/ices. 

23  (c)  Education  Initiative  on  Uses  of  Health  In- 


24   FORMATION. — 
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1  (1)  In  general. — The  Office  for  Civil  Rights 

2  within  the  Department  of  Health  and  Human  Serv- 

3  ices  shall  develop  and  maintain  a  multi-faceted  na- 

4  tional  education  initiative  to  enhance  public  trans- 

5  parency  regarding  the  uses  of  protected  health  infor- 

6  mation,  including  programs  to  educate  individuals 

7  about  the  potential  uses  of  their  health  information 

8  and  effects  of  such  uses.  Such  programs  shall  be 

9  conducted  in  a  variety  of  languages  and  present  in- 

10  formation  in  a  clear  and  understandable  manner. 

11  (2)  Authorization  of  appropriations. — 

12  There  is  authorized  to  be  appropriated  to  carry  out 

13  paragraph  (1),  $10,000,000  for  the  period  of  fiscal 

14  years  2009  through  2013. 

15  Subtitle  B — Improved  Privacy  Pro- 

16  visions  and  Additional  Security 
n  Provisions 

18  SEC.  311.  APPLICATION  OF  PENALTIES  TO  BUSINESS  ASSO- 

19  CIATES  OF  COVERED  ENTITIES  FOR  VIOLA- 

20  TIONS    OF   PRP7ACY   CONTRACT  REQUIRE- 

21  MENTS. 

22  (a)  Application  of  Contract  Requirements. — 

23  In  the  case  of  a  business  associate  of  a  covered  entity  that 

24  obtains  or  creates  protected  health  information  pursuant 

25  to  a  written  contract  (or  other  written  arrangement)  de- 
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1  scribed  in  section  164.502(e)(2)  of  title  45,  Code  of  Fed- 

2  era!  Regulations,  with  such  covered  entity,  the  business 

3  associate  may  use  and  disclose  such  protected  health  infor- 

4  mation  only  if  such  use  or  disclosure,  respectively,  is  in 

5  compliance  with  each  applicable  requirement  of  section 

6  164.504(e)  of  such  title. 

7  (b)  Application  of  Knowledge  Elements  Asso- 

8  ciated  With  Contracts. — Section  164.504(e)(1)(h)  of 

9  title  45,  Code  of  Federal  Regulations,  shall  apply  to  a 

10  business  associate  described  in  subsection  (a),  with  respect 

11  to  compliance  with  such  subsection,  in  the  same  manner 

12  that  such  section  applies  to  a  covered  entity,  with  respect 

13  to  compliance  with  the  standards  in  sections  164.502(e) 

14  and  164.504(e)  of  such  title,  except  that  in  applying  such 

15  section  164.504(e)(1)(h)  each  reference  to  the  business  as- 

16  sociate,  with  respect  to  a  contract,  shall  be  treated  as  a 

17  reference  to  the  covered  entity  involved  in  such  contract. 

18  (c)  Application  of  Civil  and  Criminal  Pen- 

19  ALTIES. — In  the  case  of  a  business  associate  that  violates 

20  any  provision  of  subsection  (a)  or  (b),  the  provisions  of 

21  sections  1176  and  1177  of  the  Social  Security  Act  shall 

22  apply  to  the  business  associate  with  respect  to  such  viola- 

23  tion  in  the  same  manner  as  such  provisions  apply  to  a 

24  person  who  violates  a  provision  of  part  C  of  title  XI  of 

25  such  Act. 
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1    SEC.  312.  RESTRICTIONS  ON  CERTAIN  DISCLOSURES  OF 


2  HEALTH    INFORMATION;    ACCOUNTING  OF 

3  CERTAIN  PROTECTED  HEALTH  INFORMATION 

4  DISCLOSURES. 

5  (a)  Requested  Restrictions  on  Certain  Dis- 


6  closures  op  Health  Information. — In  the  case  that 

7  an  individual  requests  under  paragraph  (a)(l)(i)(A)  of 

8  section  164.522  of  title  45,  Code  of  Federal  Regulations, 

9  that  a  covered  entity  restrict  the  disclosure  of  the  pro- 

10  tected  health  information  of  the  individual,  notwith- 

11  standing  paragraph  (a)(1)(h)  of  such  section,  the  covered 

12  entity  must  comply  with  the  requested  restriction  if — 


13  (1)  except  as  otherwise  required  by  law,  the  dis- 

14  closure  is  to  a  health  plan  for  purposes  of  carrying 

15  out  payment  or  health  care  operations  (and  is  not 

16  for  purposes  of  carrying  out  treatment);  and 

17  (2)  the  protected  health  information  pertains 

18  solely  to  a  health  care  item  or  service  for  which  the 

19  health  care  provider  involved  has  been  paid  out  of 

20  pocket  in  full. 

21  (b)  Disclosures  Required  To  Be  Limited  to 

22  the  Limited  Data  Set  or  the  Minimum  Nec- 

23  essary. — 

24  (1)  In  general. — A  covered  entity  shall  be 

25  treated    as    being    in    compliance    with  section 

26  164.502(b)(1)  of  title  45,  Code  of  Federal  Regula- 
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1  tions,  with  respect  to  the  use,  disclosure,  or  request 

2  of  protected  health  information  described  in  such 

3  section,  only  if  the  covered  entity  makes  reasonable 

4  efforts  to  limit  such  protected  health  information  to 

5  the    limited    data    set    (as    defined    in  section 

6  164.514(e)(2)  of  such  title)  or,  if  needed  by  such  en- 

7  tity,  to  the  minimum  necessary  to  accomplish  the  in- 

8  tended  purpose  of  such  use,  disclosure,  or  request, 

9  respectively. 

10  (2)  Application  of  exceptions. — The  excep- 

11  tions  described  in  section  164.502(b)(2)  of  title  45, 

12  Code  of  Federal  Regulations,  shall  apply  to  the  re- 

13  quirement  under  paragraph  (1)  as  of  the  effective 

14  date  described  in  section  322  in  the  same  manner 

15  that  such  exceptions  apply  to  section  164.502(b)(1) 

16  of  such  title  before  such  date. 

17  (c)  Accounting  op  Certain  Protected  Health 

18  Information  Disclosures  Required  if  Covered  En- 

19  tity  Uses  Electronic  Medical  Record. — 

20  (1)  In  general. — In  the  case  that  a  covered 

21  entity  uses  or  maintains  an  electronic  medical  record 

22  with  respect  to  protected  health  information,  the  ex- 

23  ception  under  section  164.528(a)(l)(i)  of  title  45, 

24  Code  of  Federal  Regulations,  shall  not  apply  to  dis- 
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1  closures  (other  than  oral  disclosures)  made  by  such 

2  entity  of  such  information. 

3  (2)  Electronic  medical  record  defined. — 

4  For  purposes  of  paragraph  (1),  the  term  "electronic 

5  medical  record"  means  an  electronic  record  of  indi- 

6  vidually  identifiable  health  information  on  an  indi- 

7  vidual  that  is  created,  gathered,  managed,  and  con- 

8  suited  by  authorized  clinicians  and  staff  within  a 

9  single  organization. 

10  (3)  Effective  date. — The  provisions  of  this 

11  subsection  shall  apply  to  disclosures  made  by  a  cov- 

12  ered  entity  on  or  after  the  date  specified  under  sec- 

13  tion  322. 

14  (d)  Application  of  Consent  Requirements  for 

15  Certain  Uses  and  Disclosures  by  Health  Care 

16  Providers  With  Electronic  Medical  Records. — 

17  (1)  In  general. — In  applying  section  164.506 

18  of  title  45,  Code  of  Federal  Regulations,  in  the  case 

19  of  a  covered  entity  that  is  a  health  care  provider, 

20  with  respect  to  protected  health  information  of  an 

21  individual  that  is  used  or  maintained  by  such  entity 

22  in  an  electronic  medical  record  (as  defined  in  sub- 

23  section  (c)(2)),  such  covered  entity  may  not  use  or 

24  disclose  such  protected  health  information  for  pur- 

25  poses  of  health  care  operations  unless  the  covered 
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1  entity  obtains  the  consent  of  the  individual  to  dis- 

2  close  snch  information  for  such  purposes  and  any 

3  such  consent  shall  be  revocable  by  the  individual  at 

4  any  time. 

5  (2)  Effective  date. — The  provisions  of  this 

6  subsection  shall  apply  to  disclosures  made  by  a  cov- 

7  ered  entity  on  or  after  the  date  specified  under  sec- 

8  tion  322. 

9  SEC.  313.  CONDITIONS  ON  CERTAIN  CONTACTS  AS  PART  OF 

10  HEALTH  CARE  OPERATIONS. 

1 1  (a)  In  General. — A  communication  by  a  covered  en- 

12  tity  or  business  associate  that  is  about  a  product  or  service 

13  and  that  encourages  recipients  of  the  communication  to 

14  purchase  or  use  the  product  or  service  shall  not  be  consid- 

15  ered  a  health  care  operation  for  purposes  of  subpart  E 

16  of  part  164  of  title  45,  Code  of  Federal  Regulations,  un- 

17  less  the  communication  is  made  as  described  in  subpara- 

18  graph  (i),  (ii),  or  (hi)  of  paragraph  (1)  of  the  definition 

19  of  marketing  in  section  164.501  of  such  title.  A  covered 

20  entity  or  business  associate  may  not  receive  direct  pay- 

21  ment  for  any  such  communication  made  as  described  in 

22  such  subparagraph  (i),  (ii),  or  (hi). 

23  (b)  Effective  Date. — Subsection  (a)  shall  apply  to 

24  contracting  occurring  on  or  after  the  effective  date  speci- 

25  fied  under  section  322. 
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1  SEC.  314.  STUDY  ON  APPLICATION  OF  PRD7ACY  AND  SECU- 

2  RITY  REQUIREMENTS  TO  VENDORS  OF  PER- 

3  SONAL  HEALTH  RECORDS. 

4  Not  later  than  one  year  after  the  date  of  the  enact- 

5  ment  of  this  Act,  the  Secretary  ,  in  consultation  with  the 

6  Federal  Trade  Commission,  shall  submit  to  Congress  rec- 

7  ommendations — 

8  (1)  to  identify  requirements  relating1  to  security, 

9  privacy,  and  notification  in  the  case  of  a  breach  of 

10  security  or  privacy  (including  the  applicability  of  an 

11  exemption  to  notification  in  the  case  of  protected 

12  health  information  which  has  been  rendered  indeci- 

13  pherable  through  the  use  of  encryption  or  alternative 

14  technologies)  that  should  be  applied  to  vendors  of 

15  personal  health  records  and  to  third  party  service 

16  providers  that  such  vendors  make  available  to  indi- 

17  viduals  with  personal  health  records  offered  or  main- 

18  tained  by  such  vendor,  with  respect  to  information 

19  in  such  a  record  so  offered  or  maintained;  and 

20  (2)  to  determine  which  Federal  government 

21  agency  is  best  equipped  to  enforce  such  requirements 

22  recommended  to  be  applied  to  such  vendors  of  per- 

23  sonal  health  records  and  such  third  party  service 

24  providers. 
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1  SEC.  315.  TEMPORARY  BREACH  NOTIFICATION  REQUIRE- 

2  MENT  FOR  VENDORS  OF  PERSONAL  HEALTH 

3  RECORDS. 

4  (a)  In  General. — In  accordance  with  subsection  (c), 

5  each  vendor  of  personal  health  records  shall,  following'  the 

6  discovery7  of  a  breach  of  security  of  unencrypted  individ- 

7  ually  identifiable  health  information  in  such  records  main- 

8  tained  or  offered  by  such  vendor — 

9  (1)  notify  each  individual  who  is  a  citizen  or 
10  resident  of  the  United  States  whose  unencrypted  hi- 
ll         dividually  identifiable  health  information  was  ac- 

12  quired  by  an  unauthorized  person  as  a  result  of  such 

13  a  breach  of  security;  and 

14  (2)  notify  the  Federal  Trade  Commission. 

15  (b)  Notification  of  Vendors  of  Personal 

16  Health  Records  by  Third  Party  Service  Pro- 

17  vtders. — A  third  party  service  provider  that  is  made 

1 8  available  by  a  vendor  of  personal  health  records  to  individ- 

19  uals  with  such  records  maintained  or  offered  by  such  ven- 

20  dor   and  that   accesses,   maintains,   retains,  modifies, 

21  records,  stores,  destroys,  or  otherwise  holds,  uses,  or  dis- 

22  closes  unencrypted  individually  identifiable  health  infor- 

23  mation  in  such  records  shall,  following  the  discovery  of 

24  a  breach  of  security  of  such  information,  notify  such  ven- 

25  dor  of  such  breach.  Such  notice  shall  include  the  identi- 

26  fication  of  each  individual  whose  unencrypted  individually 
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1  identifiable  health  information  has  been,  or  is  reasonably 

2  believed  to  have  been,  accessed  or  acquired  during  such 

3  breach. 

4  (c)  Application  of  Requirements  for  Timeli- 

5  ness,  Method,  and  Content  of  Notifications. — 

6  Subsections  (c),  (d),  (e),  and  (f)  of  section  302  shall  apply 

7  to  a  notification  required  under  subsection  (a)  and  a  ven- 

8  dor  of  personal  health  records  and  a  third  party  service 

9  provider  described  in  subsection  (b),  with  respect  to  a 

10  breach  of  security  under  subsection  (a)  of  unencrypted  in- 

11  dividually  identifiable  health  information  in  such  records 

12  maintained  or  offered  by  such  vendor,  in  the  same  manner 

13  that  such  subsections  apply  to  a  notification  required 

14  under  such  section  and  a  covered  entity  and  a  business 

15  associate  of  such  covered  entity,  with  respect  to  a  breach 

16  under  such  section  of  unencrypted  protected  health  infor- 

17  mation  held,  used,  or  disclosed  by  such  covered  entity. 

18  (d)  Notification  of  the  Secretary. — Upon  re- 

19  ceipt  of  a  notification  of  a  breach  of  security  under  sub- 

20  section  (a)(2),  the  Federal  Trade  Commission  shall  notify 

21  the  Secretary  of  such  breach. 

22  (e)  Enforcement. — A  violation  of  subsection  (a)  or 

23  (b)  shall  be  treated  as  an  unfair  and  deceptive  act  or  prac- 

24  tice  in  violation  of  a  regulation  under  section  18(a)(1)(B) 

25  of  the   Federal   Trade   Commission  Act   (15  U.S.C. 
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1  57a(a)(l)(B))  regarding  unfair  or  deceptive  acts  or  prac- 

2  tices. 


3  (f)  Definitions. — For  purposes  of  this  section: 

4  (1)  Breach  of  security. — The  term  "breach 

5  of  security"  means,  with  respect  to  unencrypted  in- 

6  dividually  identifiable  health  information  of  an  indi- 

7  vidua!  in  a  personal  health  record,  acquisition  of 

8  such  information  without  the  authorization  of  the  in- 

9  dividual 

10  (2)  Individually  identifiable  health  in- 

11  formation. — The   term   "individually  identifiable 

12  health  information"  has  the  meaning  given  such 

13  term  in  section  1171(6)  of  the  Social  Security  Act 

14  (42  U.S.C.  1320d(6)). 

15  (3)  Unencrypted  individually  identifi- 

16  ABLE         HEALTH         INFORMATION. — The  term 

17  "unencrypted  individually  identifiable  health  infor- 

18  mation"  means  individually  identifiable  health  infor- 

19  mation  that  is  not  protected — 

20  (A)  through  the  use  of  encryption;  or 

21  (B)  through  the  use  of  a  technology  speci- 

22  fied  by  the  Secretary  as  being  at  least  as  effec- 

23  tive  as  encryption  for  purposes  of  rendering  in- 

24  dividually  identifiable  health  information  indeci- 

25  pherable  without  authorization. 
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1  (g)  Effective  Date. — The  provisions  of  this  sec- 

2  tion  shall  apply  to  breaches  of  security  occurring  during 

3  the  2 -year  period  beginning  on  the  date  of  the  enactment 

4  of  this  Act. 

5  SEC.  316.  BUSINESS  ASSOCIATE  CONTRACTS  REQUIRED 

6  FOR  CERTAIN  ENTITIES. 

7  Each  organization,  with  respect  to  a  covered  entity, 

8  that  provides  data  transmission  of  protected  health  infor- 

9  mation  to  such  entity  and  that  requires  access  on  a  routine 

10  basis  to  such  protected  health  information,  such  as  a 

11  Health  Information  Exchange,  Regional  Health  Informa- 

12  tion  Organization,  or  E-prescribing  Gateway,  is  required 

13  to  enter  into  a  written  contract  (or  other  written  arrange- 

14  ment)  described  in  section  164.502(e)(2)  of  title  45,  Code 

15  of  Federal  Regulations,  with  such  entity  and  shall  be 

16  treated  as  a  business  associate  of  the  covered  entity  for 

17  purposes  of  section  311. 

18  SEC.  317.  GUIDANCE  ON  IMPLEMENTATION  SPECIFICATION 

19  TO  DE-IDENTIFY  PROTECTED  HEALTH  INFOR- 

20  MATION. 

21  Not  later  than  12  months  after  the  date  of  the  enact- 

22  ment  of  this  Act,  the  Secretary  shall,  in  consultation  with 

23  stakeholders,  issue  guidance  on  how  best  to  implement  the 

24  requirements  for  the  de-identification  of  protected  health 
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1  information  under  section  164.514(b)  of  title  45,  Code  of 

2  Federal  Regulations. 

3  SEC.  318.  GAO  REPORT  ON  TREATMENT  DISCLOSURES. 

4  Not  later  than  one  year  after  the  date  of  the  enact- 

5  ment  of  this  Act,  the  Comptroller  General  of  the  United 

6  States  shall  submit  to  Congress  a  report  on  the  best  prac- 

7  tices  related  to  the  disclosure  among  health  care  providers 

8  of  protected  health  information  of  an  individual  for  pur- 

9  poses  of  treatment  of  such  individual.  Such  report  shall 

10  include  an  examination  of  the  best  practices  implemented 

11  by  States  and  by  other  entities,  such  as  health  information 

12  exchanges  and  regional  health  information  organizations, 

13  including  an  examination  of  the  extent  to  which  such  best 

14  practices  are  successful  with  respect  to  the  quality  of  the 

15  resulting  health  care  provided  to  the  individual  and  with 

1 6  respect  to  the  ability  of  the  health  care  provider  to  manage 

17  such  best  practices. 

1 8  SEC.  319.  CLARIFICATION  OF  APPLICATION  OF  WRONGFUL 

19  DISCLOSURES  CRIMINAL  PENALTIES. 

20  Section  1177(a)  of  the  Social  Security  Act  (42  U.S.C. 

21  1320d-6(a))  is  amended  by  adding  at  the  end  the  fol- 

22  lowing  new  sentence:  "For  purposes  of  the  previous  sen- 

23  tence,  a  person  (including  an  employee  or  other  individual) 

24  shall  be  considered  to  have  obtained  or  disclosed  individ- 

25  ually  identifiable  health  information  in  violation  of  this 
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1  part  if  the  information  is  maintained  by  a  covered  entity 

2  (as  defined  in  the  HIPAA  privacy  regulation  described  in 

3  section  1180(b)(3))  and  the  individual  obtained  or  dis- 

4  closed  such  information  without  authorization.". 

5  Subtitle  C — Relationship  to  Other 

6  Laws;  Clarification;  Effective  Date 

7  SEC.  321.  RELATIONSHIP  TO  OTHER  LAWS. 

8  (a)  Application  of  HIPAA  State  Preemption. — 

9  Section  1178  of  the  Social  Security  Act  (42  U.S.C. 

10  1320d-7)  shall  apply  to  a  provision  or  requirement  under 

11  this  title  in  the  same  manner  that  such  section  applies 

12  to  a  provision  or  requirement  under  part  C  of  title  XI  of 

13  such  Act  or  a  standard  or  implementation  specification 

14  adopted  or  established  under  sections  1172  through  1174 

15  of  such  Act. 

16  (b)  Health  Insurance  Portability  and  Ac- 

17  COUNT  ability  Act. — The  standards  governing  the  pri- 

18  vacy  and  security  of  individually  identifiable  health  infor- 

19  mation  promulgated  by  the  Secretary  under  sections 

20  262(a)  and  264  of  the  Health  Insurance  Portability  and 

21  Accountability  Act  of  1996  shall  remain  in  effect  to  the 

22  extent  that  they  are  consistent  with  this  title.  The  Sec- 

23  retary  shall  by  rule  amend  such  Federal  regulations  as  re- 

24  quired  to  make  such  regulations  consistent  with  this  title. 
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1  SEC.  322.  EFFECTIVE  DATE. 

2  The  provisions  of  this  title  (other  than  sections 

3  301(c),  303,  314,  315,  317,  318,  and  319)  shall  take  ef- 

4  feet  on  the  date  that  is  12  months  after  the  date  of  the 

5  enactment  of  this  Act. 
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